darkcomet | fe77fee89e707c42354e319421a9a6f757af4a183c444af283088c1791983b9a

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6a18c276f74145dd2eae35d1de504ae.exe
Size

690KB
MD5

c6a18c276f74145dd2eae35d1de504ae
SHA1

ed0fba135058f1b11ccbcbb3d6dff5dc6d4ac4e4
SHA256

fe77fee89e707c42354e319421a9a6f757af4a183c444af283088c1791983b9a
SHA512

1829141cbbd690e1575379ffb594929f10057bc59e774d227deec98d718d1be7418a4d6a330429c6e670370b578f55995453bbb8d3877d41d47001c8907f4263
SSDEEP

12288:K9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZK3/Xu:GiBIGkbxqEcjsWiDxguehC2+

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

176.118.211.155:1604

Mutex

DC_MUTEX-KRQMRET

Attributes

gencode
5kbnJKrtqnGK
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

c6a18c276f74145dd2eae35d1de504ae.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSecurityPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeTakeOwnershipPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeLoadDriverPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSystemProfilePrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSystemtimePrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeProfSingleProcessPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeIncBasePriorityPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeCreatePagefilePrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeBackupPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeRestorePrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeShutdownPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeDebugPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeSystemEnvironmentPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeChangeNotifyPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeRemoteShutdownPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeUndockPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeManageVolumePrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeImpersonatePrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: SeCreateGlobalPrivilege	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: 33	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: 34	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: 35	3996	c6a18c276f74145dd2eae35d1de504ae.exe
Token: 36	3996	c6a18c276f74145dd2eae35d1de504ae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c6a18c276f74145dd2eae35d1de504ae.exe

pid process

3996 c6a18c276f74145dd2eae35d1de504ae.exe

pid	process
3996	c6a18c276f74145dd2eae35d1de504ae.exe

C:\Users\Admin\AppData\Local\Temp\c6a18c276f74145dd2eae35d1de504ae.exe
"C:\Users\Admin\AppData\Local\Temp\c6a18c276f74145dd2eae35d1de504ae.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3996-0-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/3996-1-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3996-3-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download