darkcomet | de12d7e96bd00a07099f4274731ff1e4ee681d58e0ca5934447facee666d359a

General

Target

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe
Size

1.3MB
MD5

f49845b2e7a4b36f84c99496429b64d2
SHA1

44f3023b4ca0e1273c5ba6462c6149ea5470eb11
SHA256

de12d7e96bd00a07099f4274731ff1e4ee681d58e0ca5934447facee666d359a
SHA512

77de07b5017a9b24247b747ba1b03e25575dd35cc3ae33ac3a507125c6bcf701df2983b2738477e33c5fff6a2fa630843ee43fa4809a0e1e9aeeff2682514435
SSDEEP

12288:3BHuJhZhw7Yz/2efLcOC9aF6SO+7NPJ3g2hJZa9dS7zelG64Nv9L/2Vhix6IxHbK:3ghvzcOZ6OrHOyN6IxtnN9dbWuox

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid	Process
4696	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3748 set thread context of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4696	svchost.exe
Token: SeSecurityPrivilege	4696	svchost.exe
Token: SeTakeOwnershipPrivilege	4696	svchost.exe
Token: SeLoadDriverPrivilege	4696	svchost.exe
Token: SeSystemProfilePrivilege	4696	svchost.exe
Token: SeSystemtimePrivilege	4696	svchost.exe
Token: SeProfSingleProcessPrivilege	4696	svchost.exe
Token: SeIncBasePriorityPrivilege	4696	svchost.exe
Token: SeCreatePagefilePrivilege	4696	svchost.exe
Token: SeBackupPrivilege	4696	svchost.exe
Token: SeRestorePrivilege	4696	svchost.exe
Token: SeShutdownPrivilege	4696	svchost.exe
Token: SeDebugPrivilege	4696	svchost.exe
Token: SeSystemEnvironmentPrivilege	4696	svchost.exe
Token: SeChangeNotifyPrivilege	4696	svchost.exe
Token: SeRemoteShutdownPrivilege	4696	svchost.exe
Token: SeUndockPrivilege	4696	svchost.exe
Token: SeManageVolumePrivilege	4696	svchost.exe
Token: SeImpersonatePrivilege	4696	svchost.exe
Token: SeCreateGlobalPrivilege	4696	svchost.exe
Token: 33	4696	svchost.exe
Token: 34	4696	svchost.exe
Token: 35	4696	svchost.exe
Token: 36	4696	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88
PID 3748 wrote to memory of 4696	3748	f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f49845b2e7a4b36f84c99496429b64d2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/3748-13-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/3748-1-0x0000000000D70000-0x0000000000D80000-memory.dmp

Filesize
64KB

Download
memory/3748-2-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/3748-0-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4696-18-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-20-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-14-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-9-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-15-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4696-16-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-17-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-6-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-19-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-11-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-21-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-24-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-25-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-26-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-27-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-28-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-29-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-30-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4696-31-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads