Analysis
-
max time kernel
149s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
01/12/2022, 08:11
General
-
Target
999ddd4c7354baf1fe7bbcd14c2bf34647946759b801165cc31be4acd78cf588.exe
-
Size
662KB
-
MD5
96b6e607a479cec7f2bf3c487f79cd6c
-
SHA1
22610eee0d3241a5969daab00ef24c27d289ee56
-
SHA256
999ddd4c7354baf1fe7bbcd14c2bf34647946759b801165cc31be4acd78cf588
-
SHA512
ecec6f4a6ed7e0130be6a064e4b8fe565473abe7015c6749f886ebb2c7f039839aa8cdf59d134b803bfa2d7a5c080c3de4ec25e8c3e5d04add01f0f18485a641
-
SSDEEP
12288:83OpvNW4a76S/Ddon/m09bbYlIaaMcE2YGhq3vo1RnfAvIESJgoE26yc/R4:qOA4aWNn/m09fKIaaBEtWq3A1Ov8Jgbm
Score
10/10
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\999ddd4c7354baf1fe7bbcd14c2bf34647946759b801165cc31be4acd78cf588.exe"C:\Users\Admin\AppData\Local\Temp\999ddd4c7354baf1fe7bbcd14c2bf34647946759b801165cc31be4acd78cf588.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB