darkcomet | cef3d74527702315be8fd0c7c804d0dd4a33d411c0c3c9228b9ae91019e8af52

General

Target

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe
Size

700KB
MD5

fe2a5ad05e643c977aafc479acb4f58c
SHA1

4211af0be5a8439c9204de34da69c4dee9278f79
SHA256

cef3d74527702315be8fd0c7c804d0dd4a33d411c0c3c9228b9ae91019e8af52
SHA512

7455b1cba28a39490b327699aded5302864bc8db253790d402c3128da69dcdf5a62d24ec9e90dfca781f0ff34a9665da88c28e588322461473383327398c7f56
SSDEEP

12288:qTjaLtqmSDXDfCEpcjlsgCakhPY88P3N3qFls31dDV3wSLjTd+9oKAJ:qHaZ3SDzaEpClnCJhYT/N3Ei3RSoF

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4728 set thread context of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSecurityPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeTakeOwnershipPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeLoadDriverPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSystemProfilePrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSystemtimePrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeProfSingleProcessPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeIncBasePriorityPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeCreatePagefilePrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeBackupPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeRestorePrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeShutdownPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeDebugPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeSystemEnvironmentPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeChangeNotifyPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeRemoteShutdownPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeUndockPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeManageVolumePrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeImpersonatePrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: SeCreateGlobalPrivilege	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: 33	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: 34	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: 35	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
Token: 36	4456	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

pid	Process
4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88
PID 4728 wrote to memory of 4456	4728	fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
  C:\Users\Admin\AppData\Local\Temp\fe2a5ad05e643c977aafc479acb4f58c_JaffaCakes118.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4456-17-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-9-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-4-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-5-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-10-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-7-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-3-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-8-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4456-22-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-11-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4456-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4728-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4728-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads