darkcomet | 683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2023 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Size

660KB
MD5

14ca3c71ce2ce0e25f1a3a517d09ce20
SHA1

3192ac5e494d54eda88e762e7965e75f5760b6ca
SHA256

683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2
SHA512

4c1f9621ff48f4c02a07b7cd9d86962532a3c30ed0140e4b8c70222f8734bee142d56e44e205c43d48333b4310cfb9548d6804d42491da085163b22317393d92
SSDEEP

12288:wXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uw:WnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JA

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeSecurityPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeTakeOwnershipPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeLoadDriverPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeSystemProfilePrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeSystemtimePrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeProfSingleProcessPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeIncBasePriorityPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeCreatePagefilePrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeBackupPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeRestorePrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeShutdownPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeDebugPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeSystemEnvironmentPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeChangeNotifyPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeRemoteShutdownPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeUndockPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeManageVolumePrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeImpersonatePrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: SeCreateGlobalPrivilege	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: 33	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: 34	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: 35	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
Token: 36	4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe

pid process

4060 683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe

pid	process
4060	683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe

C:\Users\Admin\AppData\Local\Temp\683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe
"C:\Users\Admin\AppData\Local\Temp\683b475415004f97043786bd1929245747d0944264f3382e7c33213dcf496de2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4060

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads