Malware Analysis Report

2024-10-19 08:01

Sample ID 240415-jkyv3acb7z
Target f099166904861ab4279bcb3363818e1b_JaffaCakes118
SHA256 b77cbf38ccd7eaffd507edd029defb701eb4f7627eb55d24b00981188af05a33
Tags
darkcomet persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b77cbf38ccd7eaffd507edd029defb701eb4f7627eb55d24b00981188af05a33

Threat Level: Known bad

The file f099166904861ab4279bcb3363818e1b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet persistence rat trojan

Darkcomet

Drops startup file

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-15 07:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-15 07:44

Reported

2024-04-15 07:46

Platform

win7-20240221-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CeUaJ.exe C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Roaming\\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe" C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3000 set thread context of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3000 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3000 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3000 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2184 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2184 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2184 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2184 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 3000 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rpvtndcb.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2492.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2491.tmp"

C:\Users\Admin\AppData\Roaming\Injection.exe

C:\Users\Admin\AppData\Roaming\Injection.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp

Files

memory/3000-1-0x0000000074620000-0x0000000074BCB000-memory.dmp

memory/3000-2-0x00000000004C0000-0x0000000000500000-memory.dmp

memory/3000-0-0x0000000074620000-0x0000000074BCB000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\rpvtndcb.cmdline

MD5 573dbcbfb712af18b3430e5d5f063ad8
SHA1 a5c5dfe85383b1688f0d250660d7f39a1218e382
SHA256 5f718e41637fae4c8e35f71004815aacaf583e1010966e02989b7800f33a93ec
SHA512 47a6e40e6e98a9bab6db637c70c887f356b659bfd8e9304ffeaeee2658a96c7a31516f672a5ff37c1aaf74c46422a72aac0e8f3e1e9e9936880ca81ee7ffab66

\??\c:\Users\Admin\AppData\Local\Temp\rpvtndcb.0.cs

MD5 6830431c6b49f72eaca4b2888a0ddaa9
SHA1 502083f68f991bfcfd771a7ba5bd508c2834591c
SHA256 ae57e8973a24563582d571743f0339d9347ffc82ed716d12a994694c2b673bf8
SHA512 939fa8cb2ca518904dea91b9612c53d833b9cf11e393fb376c1b0d00734e52b33708a6302e04bf15cb6a8e745475163766dec5a29ac265c914d0c286a170b35a

\??\c:\Users\Admin\AppData\Local\Temp\CSC2491.tmp

MD5 50faa68530824e8a94483d3aa6904a30
SHA1 7fb4d05a4be699e879d3f257690fb2697b3c0d4e
SHA256 bc8f62b6fcd058d2ae93c125c3a67d3528dca3073dd3dfb456ec07298c3bc482
SHA512 a3995c11fbab31c021e8c65a5c502622857eb33f3053945b9c8cb460923b1c19265304eec9e91bb6333d7d24f5640b35332b4c437b88943181307b396f8e0fcc

C:\Users\Admin\AppData\Local\Temp\RES2492.tmp

MD5 b08cc760a3ad3300a31aea21003467b2
SHA1 e11e1e278c9c4df3d6fed7e153f70fde6d4ab287
SHA256 4d3cfb36cfad405768837f11c9c7083cd7ac777bf7b63758d63a0320e81e939d
SHA512 f241f03291049a61d2bbc9e32464fd7f0e59c5736d4fcb254de1aa1de286fc19c6ee8a50adab53303c7598c16e1d88ca505507aaf41e7dfbfa1d73b362cb4e8c

C:\Users\Admin\AppData\Local\Temp\rpvtndcb.dll

MD5 0e37ad110648e6fea93defd082b01930
SHA1 3f04947c8827e19b7a9b4b4463e4569dcb5c5c6f
SHA256 abd15708a674c0b10edab68a9fa106a4fea873e594bdd21cb31c2799eac514ec
SHA512 1ce926845dcdeb8dfe6b6d5ca4cbcfe0b9ec57b4784111bbaff8da1082e2b385f3cb573d0732315f71af8801173bb0cc383a53e5c1abc66b0fa845fdddf8fda3

\Users\Admin\AppData\Roaming\Injection.exe

MD5 ba093215cda2c953d09cb4be4b85931f
SHA1 776090132599bca6a7d29362bba6a5893669e2a9
SHA256 8111d242686858f3a2e9adf30cd37b5c264743bfd4ad4d090ea4ce4187ce7798
SHA512 dc66ac0b2442339ec1bcbd2fa85a1e8e04d6485ea946a84a2516d96138f2c7f14bca703c71bb085669de0c4bc088e0e17927ca094273d06e01cfa0c5b1f35023

memory/2572-23-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-32-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2572-37-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-34-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-33-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-30-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-28-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-27-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-25-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-39-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-42-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-44-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-43-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-45-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2572-47-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-48-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-49-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/3000-50-0x0000000074620000-0x0000000074BCB000-memory.dmp

memory/3000-51-0x0000000074620000-0x0000000074BCB000-memory.dmp

memory/3000-52-0x00000000004C0000-0x0000000000500000-memory.dmp

memory/2572-53-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-54-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-55-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-56-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-57-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-58-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-59-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-60-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-61-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-62-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-63-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-64-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2572-65-0x0000000000400000-0x00000000004B0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-15 07:44

Reported

2024-04-15 07:46

Platform

win10v2004-20240412-en

Max time kernel

147s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CeUaJ.exe C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Roaming\\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe" C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1660 set thread context of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Roaming\Injection.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1660 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1660 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1148 wrote to memory of 4948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1148 wrote to memory of 4948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1148 wrote to memory of 4948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe
PID 1660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Injection.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8d4mczn_.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F8D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2F8C.tmp"

C:\Users\Admin\AppData\Roaming\Injection.exe

C:\Users\Admin\AppData\Roaming\Injection.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp

Files

memory/1660-0-0x0000000075520000-0x0000000075AD1000-memory.dmp

memory/1660-1-0x00000000012D0000-0x00000000012E0000-memory.dmp

memory/1660-2-0x0000000075520000-0x0000000075AD1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\8d4mczn_.cmdline

MD5 2ceb3f966886e16e02460fe9dab4b068
SHA1 7221d1887344c20e954157464807a4fe50de1948
SHA256 ea338e2fa51a2617da08d7f8d05ba8c7261b8c6348595321e6699dc54438ba3e
SHA512 ac33e4ff1df94ecfd772bacd7a7817a3bd744bc3b2ba6418daa8ba5731e189faad1d1109d3c0f8b7e1005035c2942294bee80fbfa5dd434580632a3dac35085a

\??\c:\Users\Admin\AppData\Local\Temp\8d4mczn_.0.cs

MD5 6830431c6b49f72eaca4b2888a0ddaa9
SHA1 502083f68f991bfcfd771a7ba5bd508c2834591c
SHA256 ae57e8973a24563582d571743f0339d9347ffc82ed716d12a994694c2b673bf8
SHA512 939fa8cb2ca518904dea91b9612c53d833b9cf11e393fb376c1b0d00734e52b33708a6302e04bf15cb6a8e745475163766dec5a29ac265c914d0c286a170b35a

memory/1148-9-0x0000000000A70000-0x0000000000A80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES2F8D.tmp

MD5 1b04c7ba5293a64589f022b23cbec068
SHA1 d972a0114f41c91d0f36e72cedef8735cb9e8e89
SHA256 161a37e1fa17b9aec8fbb8ebc9ad47bcb3167fa2a65740f9fc5f66e2d3051b07
SHA512 adb91ae08f2ec0c62ab673238c746641fcc0561a0abb229ef74d7d290a68a3015f4ab0d935c140f0dcb0fe93bf6fc6978bdfaae3d1f057a039d0c3dd19c2b8d7

\??\c:\Users\Admin\AppData\Local\Temp\CSC2F8C.tmp

MD5 3a0e519d5f9198bb9c536342b3e24c1f
SHA1 dc9a155928830a51dad88034a5b2fd094dfbf221
SHA256 e919dc625776507758d0b7493b4e2d4eb3ec2157f5558896debc36b907f5bd02
SHA512 0e614c116d2d7d5ff5ec52f3156c9bf1d53d8d551cd5b6ce728c7f7aa3fd9631168f5fdd000e9909d526ef2e93e73ca26bba1e7b414f3ba9a69a95c815fad66b

C:\Users\Admin\AppData\Local\Temp\8d4mczn_.dll

MD5 4b2425bc7ee4ff3c2ef8f1848395e469
SHA1 d0913ca7f9ae19c02bfd489daf7297f538d7c012
SHA256 73bbb71c2896dfd1d9837719aa6bb8c76bc5ff4a757253192c0a298feec81d8f
SHA512 dea5cf2fde0c1de58565f862e7fa7daeb8c1e79c1359b6ce3b59ffed1c9631e61bcfbd9869fe6b48de0c9e1bb85a7b49f035d1ad2d4d53bb85b9c3c2d494d14f

memory/1868-19-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Injection.exe

MD5 ba093215cda2c953d09cb4be4b85931f
SHA1 776090132599bca6a7d29362bba6a5893669e2a9
SHA256 8111d242686858f3a2e9adf30cd37b5c264743bfd4ad4d090ea4ce4187ce7798
SHA512 dc66ac0b2442339ec1bcbd2fa85a1e8e04d6485ea946a84a2516d96138f2c7f14bca703c71bb085669de0c4bc088e0e17927ca094273d06e01cfa0c5b1f35023

memory/1868-22-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-25-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-27-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-28-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-31-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-30-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-29-0x00000000022F0000-0x00000000022F1000-memory.dmp

memory/1868-32-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1660-33-0x0000000075520000-0x0000000075AD1000-memory.dmp

memory/1660-34-0x00000000012D0000-0x00000000012E0000-memory.dmp

memory/1868-35-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-36-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-37-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-38-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-39-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-40-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-41-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-42-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-43-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-44-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-45-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-46-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1868-47-0x0000000000400000-0x00000000004B0000-memory.dmp