darkcomet | fe77fee89e707c42354e319421a9a6f757af4a183c444af283088c1791983b9a

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6a18c276f74145dd2eae35d1de504ae.exe
Size

690KB
MD5

c6a18c276f74145dd2eae35d1de504ae
SHA1

ed0fba135058f1b11ccbcbb3d6dff5dc6d4ac4e4
SHA256

fe77fee89e707c42354e319421a9a6f757af4a183c444af283088c1791983b9a
SHA512

1829141cbbd690e1575379ffb594929f10057bc59e774d227deec98d718d1be7418a4d6a330429c6e670370b578f55995453bbb8d3877d41d47001c8907f4263
SSDEEP

12288:K9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZK3/Xu:GiBIGkbxqEcjsWiDxguehC2+

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

176.118.211.155:1604

Mutex

DC_MUTEX-KRQMRET

Attributes

gencode
5kbnJKrtqnGK
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

c6a18c276f74145dd2eae35d1de504ae.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSecurityPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeTakeOwnershipPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeLoadDriverPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSystemProfilePrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSystemtimePrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeProfSingleProcessPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeIncBasePriorityPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeCreatePagefilePrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeBackupPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeRestorePrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeShutdownPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeDebugPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSystemEnvironmentPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeChangeNotifyPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeRemoteShutdownPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeUndockPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeManageVolumePrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeImpersonatePrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeCreateGlobalPrivilege	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: 33	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: 34	2220	c6a18c276f74145dd2eae35d1de504ae.exe
Token: 35	2220	c6a18c276f74145dd2eae35d1de504ae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c6a18c276f74145dd2eae35d1de504ae.exe

pid process

2220 c6a18c276f74145dd2eae35d1de504ae.exe

pid	process
2220	c6a18c276f74145dd2eae35d1de504ae.exe

C:\Users\Admin\AppData\Local\Temp\c6a18c276f74145dd2eae35d1de504ae.exe
"C:\Users\Admin\AppData\Local\Temp\c6a18c276f74145dd2eae35d1de504ae.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2220-3-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download