darkcomet | 805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db

General

Target

805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Size

552KB
MD5

929ed3d7da48e80a50189d0dff1c58ea
SHA1

50c6aaae6e2336be9d8479e460c9c0d01ce90f49
SHA256

805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db
SHA512

514674074d4115a2611ead904c293f830242f5b252e0858ea9b69fc332e659556ccc5e6100b51af46777751a7820a5ce61f278ad6c1c774b31ff90982cc0b79d
SSDEEP

12288:vbdzi6VM9YIpgLXNn/kOdAPWbA+2jg/YXn7rGNrkty0fkhAkmL:viUt8z2j2j+YXnErmyFAB

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1068-56-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1068-58-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1068-61-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1068-62-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1068-63-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1068-64-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 1068	1324	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	28

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSecurityPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeTakeOwnershipPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeLoadDriverPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSystemProfilePrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSystemtimePrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeProfSingleProcessPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeIncBasePriorityPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeCreatePagefilePrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeBackupPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeRestorePrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeShutdownPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeDebugPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSystemEnvironmentPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeChangeNotifyPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeRemoteShutdownPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeUndockPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeManageVolumePrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeImpersonatePrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeCreateGlobalPrivilege	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: 33	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: 34	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: 35	1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1068	1324	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	28
PID 1324 wrote to memory of 1068	1324	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	28
PID 1324 wrote to memory of 1068	1324	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	28
PID 1324 wrote to memory of 1068	1324	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	28
PID 1324 wrote to memory of 1068	1324	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	28
PID 1324 wrote to memory of 1068	1324	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	28

C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
"C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
  "C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-56-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1068-58-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1068-57-0x00000000004B60B0-mapping.dmp

Download
memory/1068-61-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1068-62-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1068-63-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1068-64-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1324-54-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/1324-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1324-59-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download

Analysis

Sharing