darkcomet | d3fbd6d2947174c8856d0e63595bbcbaa92d96d303d5fb28042526ffbad4cc0f

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Size

658KB
MD5

9819ce7a41ac47070d178e2d3d2b29ba
SHA1

3e62f0fb38784f4606783a2604513ba22f3c08ea
SHA256

d3fbd6d2947174c8856d0e63595bbcbaa92d96d303d5fb28042526ffbad4cc0f
SHA512

cbddf14f7547ac20635ade2f8108260a4f3558cd771c0fb0499deb61305f7b1185f4a753bbd8050cd4b79301c3aa0fd2f935a8ca9f0bc2b933d77764694f64aa
SSDEEP

12288:29HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFG:SiBIGkbxqEcjsWiDxguehC2Sd

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-4KLSS74

Attributes

gencode
EftMPU0wCXcB
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeSecurityPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeBackupPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeRestorePrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeShutdownPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeDebugPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeUndockPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: 33	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: 34	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
Token: 35	1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe

pid process

1908 9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe

pid	process
1908	9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9819ce7a41ac47070d178e2d3d2b29ba_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-0-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1908-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1908-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1908-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download