darkcomet | 805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db

General

Target

805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Size

552KB
MD5

929ed3d7da48e80a50189d0dff1c58ea
SHA1

50c6aaae6e2336be9d8479e460c9c0d01ce90f49
SHA256

805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db
SHA512

514674074d4115a2611ead904c293f830242f5b252e0858ea9b69fc332e659556ccc5e6100b51af46777751a7820a5ce61f278ad6c1c774b31ff90982cc0b79d
SSDEEP

12288:vbdzi6VM9YIpgLXNn/kOdAPWbA+2jg/YXn7rGNrkty0fkhAkmL:viUt8z2j2j+YXnErmyFAB

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3328-134-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3328-135-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3328-136-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3328-138-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3328-139-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3328-140-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3328-141-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 3328	2732	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	76

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSecurityPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeTakeOwnershipPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeLoadDriverPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSystemProfilePrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSystemtimePrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeProfSingleProcessPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeIncBasePriorityPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeCreatePagefilePrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeBackupPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeRestorePrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeShutdownPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeDebugPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeSystemEnvironmentPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeChangeNotifyPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeRemoteShutdownPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeUndockPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeManageVolumePrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeImpersonatePrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: SeCreateGlobalPrivilege	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: 33	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: 34	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: 35	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
Token: 36	3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 3328	2732	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	76
PID 2732 wrote to memory of 3328	2732	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	76
PID 2732 wrote to memory of 3328	2732	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	76
PID 2732 wrote to memory of 3328	2732	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	76
PID 2732 wrote to memory of 3328	2732	805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe	76

C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
"C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe
  "C:\Users\Admin\AppData\Local\Temp\805692820c9f6b42b821b411de1749e1142f8ff2bbc71bf9c56b0c0e0dc3a9db.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-132-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/2732-137-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/3328-133-0x0000000000000000-mapping.dmp

Download
memory/3328-134-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3328-135-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3328-136-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3328-138-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3328-139-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3328-140-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3328-141-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing