darkcomet | 88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c

Analysis

max time kernel
187s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Size

662KB
MD5

1eceb73a32f0a7be6a95878a20cd9f7c
SHA1

114d8b19cf4d911544d211fa286a79e1b710ede7
SHA256

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c
SHA512

cc82cd161101f6e007bcca572c244bbb81e3948b533e9d239f3558c9afe2fd90523c6bcd630969b1085b73a087ff1c0553d77d1f7f154bde8296bd2f3c38f94f
SSDEEP

12288:c3OpvNW4a76S/Ddon/m09bbYlIaaMcE2YGhq3vo1RnfAvIESJgoE26yc/RO:KOA4aWNn/m09fKIaaBEtWq3A1Ov8Jgbw

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSecurityPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeTakeOwnershipPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeLoadDriverPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSystemProfilePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSystemtimePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeProfSingleProcessPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeIncBasePriorityPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeCreatePagefilePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeBackupPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeRestorePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeShutdownPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeDebugPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSystemEnvironmentPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeChangeNotifyPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeRemoteShutdownPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeUndockPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeManageVolumePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeImpersonatePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeCreateGlobalPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: 33	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: 34	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: 35	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

pid process

892 88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

pid	process
892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

C:\Users\Admin\AppData\Local\Temp\88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
"C:\Users\Admin\AppData\Local\Temp\88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download