Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
17-04-2024 12:56
General
-
Target
0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d.exe
-
Size
349KB
-
MD5
6049d329c2052677fe798039939ad26d
-
SHA1
476f3abe525221661686a0b93f4e0e4049e652df
-
SHA256
0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d
-
SHA512
2c4c52bc727b8613c3eeb85f601680211898b7ac51f6f303aac6251617f661e08fc916588965a5a084abd0f736600dbbc535c0bc23140b1090e02e54fd72a49d
-
SSDEEP
6144:9cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37ZSoBLLjMdWnpQZh9h4:9cW7KEZlPzCy37ZSolMd0QZh9u
Malware Config
Extracted
darkcomet
Guest16
5.tcp.eu.ngrok.io:16834
DC_MUTEX-2TZ2B4A
-
gencode
AsLmq7l6VSTm
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d.exe"C:\Users\Admin\AppData\Local\Temp\0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
928KB
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB