darkcomet | 39b076c7a60b43ebbde865920dbf71195c19514a88b233cf0e92e8a01d88fa25

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Size

647KB
MD5

ffb8edbfd431e4015709e434138670dd
SHA1

075bb27a3ba6efc5ecb5b9c44655dd1f81be1222
SHA256

39b076c7a60b43ebbde865920dbf71195c19514a88b233cf0e92e8a01d88fa25
SHA512

1360ca98fbc99003372c458cadadf914070f21d8fb19cfc1ebd6570756e8557d5f780709e5be58f140a84a6e9516917e531b32c7c2bf0b5362ebc1eb8a15fde4
SSDEEP

12288:T6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhjR:2AmBpVKHu0Mu9Xo20VGLVP5jR

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSecurityPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeBackupPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeRestorePrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeShutdownPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeDebugPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeUndockPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: 33	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: 34	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: 35	3024	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3024-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3024-1-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3024-2-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3024-3-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download