darkcomet | e2640f3dd84067bb41f2e7da1c7271b9694b896e98a6020d167326260602cea2

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 09:00

Target

f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe
Size

696KB
MD5

f9f6310d89cc57d7429b123c838beb65
SHA1

40671d539c16fa39d7f4843d7379ac7aae968ac4
SHA256

e2640f3dd84067bb41f2e7da1c7271b9694b896e98a6020d167326260602cea2
SHA512

0927e6251cfc3fab40ceaa2a7974f44d6cb410e9f0d7a02339fc971e6ac8f8317406e34deec9e8046a22be974541469314c3217c8d8bb45884aa53767f4fca56
SSDEEP

12288:0RDu8FEhfT0cPBOdt4KOFxQxduHSR3xdaRRPTZn5HPDeuOrOUl+66nBuOPy/3qxT:hZYDO6QHY3ctNcbOA+66nBLPy/6

Score

10^/10

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

Processes:

bla.exe

pid	Process
4260	bla.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	856	f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe

description	pid	Process	procid_target
PID 856 wrote to memory of 4260	856	f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe	85
PID 856 wrote to memory of 4260	856	f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe	85
PID 856 wrote to memory of 4260	856	f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9f6310d89cc57d7429b123c838beb65_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\bla.exe
  C:\Users\Admin\AppData\Local\Temp\bla.exe
  2⤵
  - Executes dropped EXE
  PID:4260

C:\Users\Admin\AppData\Local\Temp\bla.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/856-0-0x00007FF8B2EF0000-0x00007FF8B3891000-memory.dmp

Filesize
9.6MB

Download
memory/856-1-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Filesize
64KB

Download
memory/856-2-0x00007FF8B2EF0000-0x00007FF8B3891000-memory.dmp

Filesize
9.6MB

Download
memory/856-3-0x0000000000EA0000-0x0000000000EAA000-memory.dmp

Filesize
40KB

Download
memory/856-4-0x000000001B410000-0x000000001B4B6000-memory.dmp

Filesize
664KB

Download
memory/856-6-0x000000001B510000-0x000000001B5C4000-memory.dmp

Filesize
720KB

Download
memory/856-11-0x00007FF8B2EF0000-0x00007FF8B3891000-memory.dmp

Filesize
9.6MB

Download