bfe9a76229e6e502b7c542007cd976dd3b5e0d26190cdf7cc8a5e5aab0a63f7d | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/10/2024, 11:11

Sharing

Report Analysis Logs

General

Target

Darkcomet RAT 5.3.1.zip
Size

14.6MB
MD5

9f9347ecf2cc6541fb64acd6fc0a5749
SHA1

6c0d454ec2068d1c7d502a167ca02c8dafd0b244
SHA256

bfe9a76229e6e502b7c542007cd976dd3b5e0d26190cdf7cc8a5e5aab0a63f7d
SHA512

f0367a7c7265d38e52936bac40e0a18236d6544827da7dcdd1f2b19d2d3193b0039f5860a61a30f4e28bca3d2ef06a9c51f1b2c7f05927fad6ba37741ff015f3
SSDEEP

393216:Yia1rsEqp8mxBktqBEH3JM/qbxhbRLEJt5RXtW3hg:Yl1rsEqJxChH3coxhbePK3hg

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2500	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2500	7zFM.exe
Token: 35	2500	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Darkcomet RAT 5.3.1.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads