darkcomet | 63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1

Analysis

max time kernel
167s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Size

644KB
MD5

d3e7305fd210a0d1e5c35599d295a4d1
SHA1

abbc3d77fbf0aee002829b91a66affb9d8c58959
SHA256

63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1
SHA512

13c2187b427edc798ef9dcc9d012fe5113259ffd19a32f3aa94c3de513aef82694e202119d73ee9f3d65b6fa107d82fc2ebbedd1dbb03af380150c133ec8b478
SSDEEP

12288:J9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h:TZ1xuVVjfFoynPaVBUR8f+kN10EB

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeSecurityPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeTakeOwnershipPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeLoadDriverPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeSystemProfilePrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeSystemtimePrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeProfSingleProcessPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeIncBasePriorityPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeCreatePagefilePrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeBackupPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeRestorePrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeShutdownPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeDebugPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeSystemEnvironmentPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeChangeNotifyPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeRemoteShutdownPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeUndockPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeManageVolumePrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeImpersonatePrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: SeCreateGlobalPrivilege	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: 33	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: 34	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: 35	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
Token: 36	2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe

C:\Users\Admin\AppData\Local\Temp\63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe
"C:\Users\Admin\AppData\Local\Temp\63308e54cf88216e9e2398cb848a02cdda578c9e7de9ba527382390401c5c4f1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads