darkcomet | de12d7e96bd00a07099f4274731ff1e4ee681d58e0ca5934447facee666d359a

General

Target

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe
Size

1.3MB
MD5

f49845b2e7a4b36f84c99496429b64d2
SHA1

44f3023b4ca0e1273c5ba6462c6149ea5470eb11
SHA256

de12d7e96bd00a07099f4274731ff1e4ee681d58e0ca5934447facee666d359a
SHA512

77de07b5017a9b24247b747ba1b03e25575dd35cc3ae33ac3a507125c6bcf701df2983b2738477e33c5fff6a2fa630843ee43fa4809a0e1e9aeeff2682514435
SSDEEP

12288:3BHuJhZhw7Yz/2efLcOC9aF6SO+7NPJ3g2hJZa9dS7zelG64Nv9L/2Vhix6IxHbK:3ghvzcOZ6OrHOyN6IxtnN9dbWuox

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid	Process
2328	svchost.exe

Loads dropped DLL 1 IoCs

Processes:

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe

pid	Process
2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2108 set thread context of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2328	svchost.exe
Token: SeSecurityPrivilege	2328	svchost.exe
Token: SeTakeOwnershipPrivilege	2328	svchost.exe
Token: SeLoadDriverPrivilege	2328	svchost.exe
Token: SeSystemProfilePrivilege	2328	svchost.exe
Token: SeSystemtimePrivilege	2328	svchost.exe
Token: SeProfSingleProcessPrivilege	2328	svchost.exe
Token: SeIncBasePriorityPrivilege	2328	svchost.exe
Token: SeCreatePagefilePrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeRestorePrivilege	2328	svchost.exe
Token: SeShutdownPrivilege	2328	svchost.exe
Token: SeDebugPrivilege	2328	svchost.exe
Token: SeSystemEnvironmentPrivilege	2328	svchost.exe
Token: SeChangeNotifyPrivilege	2328	svchost.exe
Token: SeRemoteShutdownPrivilege	2328	svchost.exe
Token: SeUndockPrivilege	2328	svchost.exe
Token: SeManageVolumePrivilege	2328	svchost.exe
Token: SeImpersonatePrivilege	2328	svchost.exe
Token: SeCreateGlobalPrivilege	2328	svchost.exe
Token: 33	2328	svchost.exe
Token: 34	2328	svchost.exe
Token: 35	2328	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28
PID 2108 wrote to memory of 2328	2108	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/2108-0-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2108-1-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2108-2-0x00000000021A0000-0x00000000021E0000-memory.dmp

Filesize
256KB

Download
memory/2108-32-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2328-16-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-28-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-14-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-20-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-18-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-12-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-22-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2328-26-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-8-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-31-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-10-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-33-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-35-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-37-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2328-36-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2328-38-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads