darkcomet | 542892dc639bb13bbc6ffb0e7cb10cdecab1c33ac01ee79633496301b1f7e2cc

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DarkComet_jz5u.com/DarkComet汉化.exe
Size

11.3MB
MD5

04bde5caf3c66f1e693fce5e56251b81
SHA1

f2952503849fc787ce918b5884b9853c85553c90
SHA256

7090190e99f5afc62b474af7d938ec54f47d353dc24017a678da7a4b0b7ba2f4
SHA512

69c63bdefcfb79a04922b8a2af31b6acdd18228f02fad067c63a6ecb748297e583f718a543420a99b82468d46cca0a049f98dfd8697283d05289b7a09cd2b956
SSDEEP

196608:PPvqxSrDTVokQwhM/kUEMTQINokXJw7tWz40VqqQPt:HCxSrFokQw2TjUYqWM0l

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

DarkComet汉化.exe

pid process

2836 DarkComet汉化.exe
2836 DarkComet汉化.exe
2836 DarkComet汉化.exe
2836 DarkComet汉化.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

DarkComet汉化.exe

pid process

2836 DarkComet汉化.exe
2836 DarkComet汉化.exe
2836 DarkComet汉化.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DarkComet汉化.exe

pid process

2836 DarkComet汉化.exe

pid	process
2836	DarkComet汉化.exe
2836	DarkComet汉化.exe
2836	DarkComet汉化.exe
2836	DarkComet汉化.exe

pid	process
2836	DarkComet汉化.exe
2836	DarkComet汉化.exe
2836	DarkComet汉化.exe

pid	process
2836	DarkComet汉化.exe

C:\Users\Admin\AppData\Local\Temp\DarkComet_jz5u.com\DarkComet汉化.exe
"C:\Users\Admin\AppData\Local\Temp\DarkComet_jz5u.com\DarkComet汉化.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2836

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DarkComet_jz5u.com\config.ini
Filesize
572B

MD5
3ba645b7459d0766c92f4a2e3236ebef

SHA1
7a34107e841a61fff7f104758289cb8b6822a771

SHA256
a8a243827e142e12507ddf325f88855b193dac1bebb6f77e07c9bcdf45fac762

SHA512
1cdedd08189be4bc64b2250660bc1a395fb7c74055a04e2a4e16aca27f96b348dedfd9d3177bbb2d44186b5ed5558d2e8417a007bd1009a076508c85211110a1

Download Submit
memory/2836-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2836-1-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/2836-39-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2836-40-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/2836-41-0x0000000000400000-0x0000000000F66000-memory.dmp

Filesize
11.4MB

Download
memory/2836-42-0x0000000000400000-0x0000000000F66000-memory.dmp

Filesize
11.4MB

Download