darkcomet | 39b076c7a60b43ebbde865920dbf71195c19514a88b233cf0e92e8a01d88fa25

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Size

647KB
MD5

ffb8edbfd431e4015709e434138670dd
SHA1

075bb27a3ba6efc5ecb5b9c44655dd1f81be1222
SHA256

39b076c7a60b43ebbde865920dbf71195c19514a88b233cf0e92e8a01d88fa25
SHA512

1360ca98fbc99003372c458cadadf914070f21d8fb19cfc1ebd6570756e8557d5f780709e5be58f140a84a6e9516917e531b32c7c2bf0b5362ebc1eb8a15fde4
SSDEEP

12288:T6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhjR:2AmBpVKHu0Mu9Xo20VGLVP5jR

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSecurityPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeBackupPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeRestorePrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeShutdownPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeDebugPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeUndockPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: 33	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: 34	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: 35	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
Token: 36	2388	ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffb8edbfd431e4015709e434138670dd_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-0-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2388-2-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download