darkcomet | 6dd06780f4dacd0f0fc9f044d6200e989e9435ef8977cc3a1396aebad13b1caf

General

Target

f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
Size

796KB
MD5

f1ab64464f0534e75123ab6e5f42dd6c
SHA1

d9f427e676c7d17a2d2fdafd72ff383361014c83
SHA256

6dd06780f4dacd0f0fc9f044d6200e989e9435ef8977cc3a1396aebad13b1caf
SHA512

89ea99a14dad6a9e94dd191b32e5483472fbcaa3678fdc5a3ed3b0f3a177f2c6da20713705b9a9b517bea55364a8a3bc9c9181ccbfad6d3d87b2fa29bcc321e8
SSDEEP

12288:PKJRoPSM52au1bbL35noWJYjmAPjTrbksHMntHGrxV5YzJbotc6vq20QPXn:GKSc2autL3WOYNLStHGr+9ktc6vqm/

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1136 set thread context of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 2884 set thread context of 2648	2884	cvtres.exe	29

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2884	cvtres.exe
Token: SeSecurityPrivilege	2884	cvtres.exe
Token: SeTakeOwnershipPrivilege	2884	cvtres.exe
Token: SeLoadDriverPrivilege	2884	cvtres.exe
Token: SeSystemProfilePrivilege	2884	cvtres.exe
Token: SeSystemtimePrivilege	2884	cvtres.exe
Token: SeProfSingleProcessPrivilege	2884	cvtres.exe
Token: SeIncBasePriorityPrivilege	2884	cvtres.exe
Token: SeCreatePagefilePrivilege	2884	cvtres.exe
Token: SeBackupPrivilege	2884	cvtres.exe
Token: SeRestorePrivilege	2884	cvtres.exe
Token: SeShutdownPrivilege	2884	cvtres.exe
Token: SeDebugPrivilege	2884	cvtres.exe
Token: SeSystemEnvironmentPrivilege	2884	cvtres.exe
Token: SeChangeNotifyPrivilege	2884	cvtres.exe
Token: SeRemoteShutdownPrivilege	2884	cvtres.exe
Token: SeUndockPrivilege	2884	cvtres.exe
Token: SeManageVolumePrivilege	2884	cvtres.exe
Token: SeImpersonatePrivilege	2884	cvtres.exe
Token: SeCreateGlobalPrivilege	2884	cvtres.exe
Token: 33	2884	cvtres.exe
Token: 34	2884	cvtres.exe
Token: 35	2884	cvtres.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 1136 wrote to memory of 2884	1136	f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe	28
PID 2884 wrote to memory of 2648	2884	cvtres.exe	29
PID 2884 wrote to memory of 2648	2884	cvtres.exe	29
PID 2884 wrote to memory of 2648	2884	cvtres.exe	29
PID 2884 wrote to memory of 2648	2884	cvtres.exe	29
PID 2884 wrote to memory of 2648	2884	cvtres.exe	29
PID 2884 wrote to memory of 2648	2884	cvtres.exe	29

C:\Users\Admin\AppData\Local\Temp\f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1ab64464f0534e75123ab6e5f42dd6c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-0-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-1-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-2-0x0000000000130000-0x0000000000170000-memory.dmp

Filesize
256KB

Download
memory/1136-24-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-18-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2884-12-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-16-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-10-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-11-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-8-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2884-15-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-9-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-7-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-17-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-20-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2884-19-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-5-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-22-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2884-3-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing