darkcomet | 38ecd893e32b6fcfff524f8ab2dc952ef1d7ecf9124babade5321aa29c15ab37

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe
Size 688KB
Sample240415-rfgd8agc28
SHA256 38ecd893e32b6fcfff524f8ab2dc952ef1d7ecf9124babade5321aa29c15ab37
MD5 f13e447b8cb18af6955efa0954a34c7e
SHA1 c3e17a3773c31dfbdcebbdfdb2cda5e00ab424b8
SHA512 22bc64c826f6a9ee3c0bfe3afd1aa04d1a589a6f2b9584ac4b194ba2559cd3bfd0c9200a6330566ba529679de4a6f0d2122985edd4830489fafccf03356aa80c
SSDEEP 12288:63xq6RzaP1mBH1x/mTjTPjBbJLIhRyoYv/ji+bnj3Dz9ceUMK/f+qdXfcviU8:6BqCE1mjxuTjrjTUh8xvLLbhRqeqdXfD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	4984	WerFault.exe	88

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88
PID 2756 wrote to memory of 4984	2756	f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f13e447b8cb18af6955efa0954a34c7e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 12
    3⤵
    - Program crash
    PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4984 -ip 4984
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x0000000074E80000-0x0000000075431000-memory.dmp

Download

memory/2756-1-0x00000000014D0000-0x00000000014E0000-memory.dmp

Download

memory/2756-2-0x0000000074E80000-0x0000000075431000-memory.dmp

Download

memory/2756-5-0x0000000074E80000-0x0000000075431000-memory.dmp

Download

memory/4984-3-0x0000000013140000-0x00000000131F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads