darkcomet | 38ca3e9e674fed0178ad091d820fe17d7efee2c8b3dcc43e2761ffa85d1d2097

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b2b8170a6e11bb840491f55d9a7862.exe
Size

658KB
MD5

80b2b8170a6e11bb840491f55d9a7862
SHA1

b16ee63e7c3d5005134a5acbb343d25e82d7e484
SHA256

38ca3e9e674fed0178ad091d820fe17d7efee2c8b3dcc43e2761ffa85d1d2097
SHA512

e3688b4d859a1ff95a10d42c919e4486f2802154bf795690cf8325e0310e6afec248e93ece778eb072ac97afb30f261535088526f0a7cc2e53b89f474317f6d9
SSDEEP

12288:i9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hp:OZ1xuVVjfFoynPaVBUR8f+kN10EBT

Score

10^/10

darkcomet slave rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Slave

hehehe0.zapto.org:1604

Mutex

DC_MUTEX-BGUJELT

Attributes

gencode
3uS2CTqGNFub
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

80b2b8170a6e11bb840491f55d9a7862.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeSecurityPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeTakeOwnershipPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeLoadDriverPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeSystemProfilePrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeSystemtimePrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeProfSingleProcessPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeIncBasePriorityPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeCreatePagefilePrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeBackupPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeRestorePrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeShutdownPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeDebugPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeSystemEnvironmentPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeChangeNotifyPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeRemoteShutdownPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeUndockPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeManageVolumePrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeImpersonatePrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: SeCreateGlobalPrivilege	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: 33	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: 34	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: 35	4940	80b2b8170a6e11bb840491f55d9a7862.exe
Token: 36	4940	80b2b8170a6e11bb840491f55d9a7862.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

80b2b8170a6e11bb840491f55d9a7862.exe

pid process

4940 80b2b8170a6e11bb840491f55d9a7862.exe

pid	process
4940	80b2b8170a6e11bb840491f55d9a7862.exe

C:\Users\Admin\AppData\Local\Temp\80b2b8170a6e11bb840491f55d9a7862.exe
"C:\Users\Admin\AppData\Local\Temp\80b2b8170a6e11bb840491f55d9a7862.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4940

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-0-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/4940-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-3-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-5-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-6-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-7-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-8-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-9-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-12-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-13-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4940-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download