darkcomet | 73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6

Analysis

max time kernel
318s
max time network
366s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe
Size

839KB
MD5

e42a2e438559313d3220bf5253cffc75
SHA1

128cb5214a6148e66b1a43ca64509fcaf622b2ce
SHA256

73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6
SHA512

5f557f40eda2b756a89d5ed0836da0763ed8d4f7f0a5c475c285cd163267c2cb568d1e22304ee7394767441fb57ab09b330fd7e9560ee8b9c341ee3e7e36112d
SSDEEP

12288:Cw+VcKJDFuYlTjsMd/8D3xTS9CJTYtVSHfnLPAXpsx0GaLc/PdzFFkh+8OD6CZ0:CXDFbsMd/03xTK8TYWHM5sx0Nc/+vPU

Score

10^/10

darkcomet clouds rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Clouds

darkeyebrow.no-ip.org:1604

Mutex

DCMIN_MUTEX-W4XVV25

Attributes

gencode
8jAFNXTeDvnp
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe

description	pid	process	target process
PID 4592 set thread context of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe
Token: SeIncreaseQuotaPrivilege	4940	AppLaunch.exe
Token: SeSecurityPrivilege	4940	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	4940	AppLaunch.exe
Token: SeLoadDriverPrivilege	4940	AppLaunch.exe
Token: SeSystemProfilePrivilege	4940	AppLaunch.exe
Token: SeSystemtimePrivilege	4940	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	4940	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	4940	AppLaunch.exe
Token: SeCreatePagefilePrivilege	4940	AppLaunch.exe
Token: SeBackupPrivilege	4940	AppLaunch.exe
Token: SeRestorePrivilege	4940	AppLaunch.exe
Token: SeShutdownPrivilege	4940	AppLaunch.exe
Token: SeDebugPrivilege	4940	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	4940	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4940	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	4940	AppLaunch.exe
Token: SeUndockPrivilege	4940	AppLaunch.exe
Token: SeManageVolumePrivilege	4940	AppLaunch.exe
Token: SeImpersonatePrivilege	4940	AppLaunch.exe
Token: SeCreateGlobalPrivilege	4940	AppLaunch.exe
Token: 33	4940	AppLaunch.exe
Token: 34	4940	AppLaunch.exe
Token: 35	4940	AppLaunch.exe
Token: 36	4940	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AppLaunch.exe

pid process

4940 AppLaunch.exe

pid	process
4940	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe

description	pid	process	target process
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe
PID 4592 wrote to memory of 4940	4592	73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe
"C:\Users\Admin\AppData\Local\Temp\73cf89c6f3fb74f1d4307bc43fa5db4ffb5f62da8ec2240e6d8c6d05159156a6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4592-132-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4592-133-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4592-138-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4940-134-0x0000000000000000-mapping.dmp

Download
memory/4940-135-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4940-136-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4940-137-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download