darkcomet | cef3d74527702315be8fd0c7c804d0dd4a33d411c0c3c9228b9ae91019e8af52

General

Target

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe
Size

700KB
MD5

fe2a5ad05e643c977aafc479acb4f58c
SHA1

4211af0be5a8439c9204de34da69c4dee9278f79
SHA256

cef3d74527702315be8fd0c7c804d0dd4a33d411c0c3c9228b9ae91019e8af52
SHA512

7455b1cba28a39490b327699aded5302864bc8db253790d402c3128da69dcdf5a62d24ec9e90dfca781f0ff34a9665da88c28e588322461473383327398c7f56
SSDEEP

12288:qTjaLtqmSDXDfCEpcjlsgCakhPY88P3N3qFls31dDV3wSLjTd+9oKAJ:qHaZ3SDzaEpClnCJhYT/N3Ei3RSoF

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1540 set thread context of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSecurityPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeTakeOwnershipPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeLoadDriverPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSystemProfilePrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSystemtimePrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeProfSingleProcessPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeIncBasePriorityPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeCreatePagefilePrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeBackupPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeRestorePrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeShutdownPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeDebugPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSystemEnvironmentPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeChangeNotifyPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeRemoteShutdownPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeUndockPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeManageVolumePrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeImpersonatePrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeCreateGlobalPrivilege	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: 33	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: 34	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: 35	2740	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

pid	Process
1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28
PID 1540 wrote to memory of 2740	1540	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
  C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1540-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1540-4-0x00000000003D0000-0x00000000003DD000-memory.dmp

Filesize
52KB

Download
memory/2740-8-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-3-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-7-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-5-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2740-10-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-11-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2740-14-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads