darkcomet | 90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2

Analysis

max time kernel
152s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Size

658KB
MD5

d131b9cc9a6f1ca0f244d29b7658667e
SHA1

ee16bf6f3da40a7e9db400135c666f0e2d393d6a
SHA256

90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2
SHA512

7b678512badb4f7749b890c330db65f34fffe35903078266524d614385bd147adbd6765ee91d64ab306b10ef776190320d3d0c49b3f0b757e3aaef49ea81a776
SSDEEP

12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hb:GZ1xuVVjfFoynPaVBUR8f+kN10EBp

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeSecurityPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeTakeOwnershipPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeLoadDriverPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeSystemProfilePrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeSystemtimePrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeProfSingleProcessPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeIncBasePriorityPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeCreatePagefilePrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeBackupPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeRestorePrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeShutdownPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeDebugPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeSystemEnvironmentPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeChangeNotifyPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeRemoteShutdownPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeUndockPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeManageVolumePrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeImpersonatePrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: SeCreateGlobalPrivilege	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: 33	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: 34	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
Token: 35	2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe

pid process

2040 90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe

pid	process
2040	90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe

C:\Users\Admin\AppData\Local\Temp\90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe
"C:\Users\Admin\AppData\Local\Temp\90b39460245926d4f5d7dc1fc718c1e922553360e9211c4349d82c568cb94ea2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download