darkcomet | 9ba41cd0356b6dcd14220e3d8cf7dc3ede3affb42aec2e8713cfbc850e540ace

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Size

875KB
MD5

f8c595b0ee2de1b5bcfe30ba5f78e25d
SHA1

77a0fdfe5c252cce12e66706514d0d56bb14b86f
SHA256

9ba41cd0356b6dcd14220e3d8cf7dc3ede3affb42aec2e8713cfbc850e540ace
SHA512

0087c96eb714dfb205833bfd51f86da329c9f3ad9d3d8a763042e60d3faecf01a95f4ce5eb1e696ec5473ef8b033b7868b70f73fcfdbdd1ed9beba7c70f6619c
SSDEEP

12288:r9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK2P0JfLY1S8xul:5AQ6Zx9cxTmOrucTIEFSpOGn0J8k8x

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exeexplorer.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2184 set thread context of 2540	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exeexplorer.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exeexplorer.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exeexplorer.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeSecurityPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeBackupPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeRestorePrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeShutdownPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeDebugPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeUndockPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: 33	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: 34	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: 35	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2540	explorer.exe
Token: SeSecurityPrivilege	2540	explorer.exe
Token: SeTakeOwnershipPrivilege	2540	explorer.exe
Token: SeLoadDriverPrivilege	2540	explorer.exe
Token: SeSystemProfilePrivilege	2540	explorer.exe
Token: SeSystemtimePrivilege	2540	explorer.exe
Token: SeProfSingleProcessPrivilege	2540	explorer.exe
Token: SeIncBasePriorityPrivilege	2540	explorer.exe
Token: SeCreatePagefilePrivilege	2540	explorer.exe
Token: SeBackupPrivilege	2540	explorer.exe
Token: SeRestorePrivilege	2540	explorer.exe
Token: SeShutdownPrivilege	2540	explorer.exe
Token: SeDebugPrivilege	2540	explorer.exe
Token: SeSystemEnvironmentPrivilege	2540	explorer.exe
Token: SeChangeNotifyPrivilege	2540	explorer.exe
Token: SeRemoteShutdownPrivilege	2540	explorer.exe
Token: SeUndockPrivilege	2540	explorer.exe
Token: SeManageVolumePrivilege	2540	explorer.exe
Token: SeImpersonatePrivilege	2540	explorer.exe
Token: SeCreateGlobalPrivilege	2540	explorer.exe
Token: 33	2540	explorer.exe
Token: 34	2540	explorer.exe
Token: 35	2540	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid	Process
888	DllHost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2184 wrote to memory of 2540	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2540	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2540	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2540	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2540	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2540	2184	f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Checks BIOS information in registry
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2540

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\171284_10150094366249207_737739206_5943051_2750412_O.JPG

Filesize
185KB

MD5
927490f6ca182446b623f891cd660d40

SHA1
6bed76bc9444450922aba5574f92ea6d7338c619

SHA256
6eb4323f996e9742fb391613f9fa007088812401b284350e773a8ed336569e0d

SHA512
ca129dadf258479ad8649cf019072040f3c1907407d6ff4f7e5e5199273db0bdb04db49d3be3543b123137c3e4cc66485da41d56849de815049ff3814ed97cc0

Download Submit
memory/888-3-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/888-4-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/888-18-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/2184-0-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/2184-2-0x0000000003680000-0x0000000003682000-memory.dmp

Filesize
8KB

Download
memory/2184-11-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-13-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-10-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-12-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2540-14-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-15-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2540-16-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-17-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-6-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download
memory/2540-19-0x0000000013140000-0x000000001322D000-memory.dmp

Filesize
948KB

Download