Analysis
-
max time kernel
7s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 01:56
General
-
Target
238df395c33b4b139cdfcd48a871b759.exe
-
Size
911KB
-
MD5
238df395c33b4b139cdfcd48a871b759
-
SHA1
b83cb7d627cdcf46a6ed89f68644ef5f2d9ed20f
-
SHA256
97e81fe572b0b43a79a678e04d1ec5f1c11243087e73708d0a1486eb3cc657ff
-
SHA512
be3654267d03d6f822497b52e34f3e77bd508d797d7184541528ae893f6784ffa754f040b1cfb46db79a1a9c43e097ca2228d6c180d189886aecc9aede65a8b4
-
SSDEEP
12288:d8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1r/f:uUKoN0bUxgGa/pfBHDb+y1L
Score
10/10
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\238df395c33b4b139cdfcd48a871b759.exe"C:\Users\Admin\AppData\Local\Temp\238df395c33b4b139cdfcd48a871b759.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
916KB
-
Filesize
4KB
-
Filesize
916KB
-
Filesize
916KB
-
Filesize
4KB
-
Filesize
916KB