darkcomet | ef9c6d7b0bc00a929df36270d65002fcdfdd234fc5fc220c7fdf9d23a14a2a43

Analysis

max time kernel
144s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 03:20

Target

fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe
Size

684KB
MD5

fbd00ae632c571ccb70fddb7879fd191
SHA1

65dae1b2b58bdd65fff041ac5ed0c877b9614ea6
SHA256

ef9c6d7b0bc00a929df36270d65002fcdfdd234fc5fc220c7fdf9d23a14a2a43
SHA512

4e1a99da7fa1689f678bdbc45cf3dd5b3daafb7c1761f41af769cdae4bb889eee74de398e1a2479b4becc09a239eed9ae1e01bcb35ac4137bcc4b69df05575f5
SSDEEP

12288:7W6dg0huGaQG+aMOWnTJ8KioqUX4HcDhU4hICNTCUXG9Wpzx:i6dg0hpaQG3wn9DpDot4QUXGA

Score

10^/10

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid	Process
4528	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	656	fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe

description	pid	Process	procid_target
PID 656 wrote to memory of 4528	656	fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe	86
PID 656 wrote to memory of 4528	656	fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe	86
PID 656 wrote to memory of 4528	656	fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbd00ae632c571ccb70fddb7879fd191_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:4528

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/656-0-0x000000001B580000-0x000000001B58A000-memory.dmp

Filesize
40KB

Download
memory/656-1-0x00007FFF4B610000-0x00007FFF4BFB1000-memory.dmp

Filesize
9.6MB

Download
memory/656-3-0x000000001B640000-0x000000001B6E6000-memory.dmp

Filesize
664KB

Download
memory/656-2-0x00000000010A0000-0x00000000010B0000-memory.dmp

Filesize
64KB

Download
memory/656-4-0x00007FFF4B610000-0x00007FFF4BFB1000-memory.dmp

Filesize
9.6MB

Download
memory/656-6-0x000000001B770000-0x000000001B823000-memory.dmp

Filesize
716KB

Download
memory/656-10-0x00007FFF4B610000-0x00007FFF4BFB1000-memory.dmp

Filesize
9.6MB

Download