darkcomet | 29d04b65d7fa77a28a4906a2f0d8c1cee2ab3784cb6cdd4a31d1c4bb8abd09c6

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Size

283KB
MD5

ffbb51b968abc45197bef0cd465fe72f
SHA1

5d44ac78f2351c3d837ed52bc1b4a75473960ce1
SHA256

29d04b65d7fa77a28a4906a2f0d8c1cee2ab3784cb6cdd4a31d1c4bb8abd09c6
SHA512

dc5532305a2b3e0420a2021656e00b9ca03a31c28503f07e946a2de1bc44256d4649a447dc5ac24d109946f5acf3aa3409e6f564f7dcde1e540e7decc793ee71
SSDEEP

6144:B2aZdLuq/i+iXRx9CjEZOyatGJrP8tZnLVx1UOAsO:JZXMRLCjEZOyNJbWZhx10

Score

10^/10

darkcomet corel-kg evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Corel-KG

rizzlanet1.myftp.org:4337

Mutex

MUTEX-874ZYS2

Attributes

InstallPath
Corel Draw-X5\corelX5.exe
gencode
UbyJ1x4tmEtj
install
true
offline_keylogger
true
password
pawndu2
persistence
true
reg_key
CorelX5

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\Corel Draw-X5\\corelX5.exe"	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2736	attrib.exe
2456	attrib.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid	Process
2284	notepad.exe

Executes dropped EXE 2 IoCs

Processes:

corelX5.execorelX5.exe

pid	Process
2608	corelX5.exe
2376	corelX5.exe

Loads dropped DLL 3 IoCs

Processes:

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.execorelX5.exe

pid	Process
1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
2608	corelX5.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1744-2-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1744-3-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1744-6-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1744-8-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1744-9-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1744-10-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1744-11-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2376-57-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1744-60-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2376-63-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.execorelX5.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\CorelX5 = "C:\\Users\\Admin\\Documents\\Corel Draw-X5\\corelX5.exe"	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\CorelX5 = "C:\\Users\\Admin\\Documents\\Corel Draw-X5\\corelX5.exe"	corelX5.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.execorelX5.exe

description	pid	Process	procid_target
PID 2936 set thread context of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2608 set thread context of 2376	2608	corelX5.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.execorelX5.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeSecurityPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeBackupPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeRestorePrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeShutdownPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeDebugPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeUndockPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: 33	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: 34	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: 35	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2376	corelX5.exe
Token: SeSecurityPrivilege	2376	corelX5.exe
Token: SeTakeOwnershipPrivilege	2376	corelX5.exe
Token: SeLoadDriverPrivilege	2376	corelX5.exe
Token: SeSystemProfilePrivilege	2376	corelX5.exe
Token: SeSystemtimePrivilege	2376	corelX5.exe
Token: SeProfSingleProcessPrivilege	2376	corelX5.exe
Token: SeIncBasePriorityPrivilege	2376	corelX5.exe
Token: SeCreatePagefilePrivilege	2376	corelX5.exe
Token: SeBackupPrivilege	2376	corelX5.exe
Token: SeRestorePrivilege	2376	corelX5.exe
Token: SeShutdownPrivilege	2376	corelX5.exe
Token: SeDebugPrivilege	2376	corelX5.exe
Token: SeSystemEnvironmentPrivilege	2376	corelX5.exe
Token: SeChangeNotifyPrivilege	2376	corelX5.exe
Token: SeRemoteShutdownPrivilege	2376	corelX5.exe
Token: SeUndockPrivilege	2376	corelX5.exe
Token: SeManageVolumePrivilege	2376	corelX5.exe
Token: SeImpersonatePrivilege	2376	corelX5.exe
Token: SeCreateGlobalPrivilege	2376	corelX5.exe
Token: 33	2376	corelX5.exe
Token: 34	2376	corelX5.exe
Token: 35	2376	corelX5.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exeffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.execmd.execmd.execorelX5.execorelX5.exe

description	pid	Process	procid_target
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 2936 wrote to memory of 1744	2936	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	28
PID 1744 wrote to memory of 2168	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2168	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2168	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2168	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	29
PID 1744 wrote to memory of 3044	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	30
PID 1744 wrote to memory of 3044	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	30
PID 1744 wrote to memory of 3044	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	30
PID 1744 wrote to memory of 3044	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	30
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2284	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2456	3044	cmd.exe	34
PID 3044 wrote to memory of 2456	3044	cmd.exe	34
PID 3044 wrote to memory of 2456	3044	cmd.exe	34
PID 3044 wrote to memory of 2456	3044	cmd.exe	34
PID 2168 wrote to memory of 2736	2168	cmd.exe	35
PID 2168 wrote to memory of 2736	2168	cmd.exe	35
PID 2168 wrote to memory of 2736	2168	cmd.exe	35
PID 2168 wrote to memory of 2736	2168	cmd.exe	35
PID 1744 wrote to memory of 2608	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	36
PID 1744 wrote to memory of 2608	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	36
PID 1744 wrote to memory of 2608	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	36
PID 1744 wrote to memory of 2608	1744	ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe	36
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2608 wrote to memory of 2376	2608	corelX5.exe	37
PID 2376 wrote to memory of 2616	2376	corelX5.exe	38
PID 2376 wrote to memory of 2616	2376	corelX5.exe	38
PID 2376 wrote to memory of 2616	2376	corelX5.exe	38
PID 2376 wrote to memory of 2616	2376	corelX5.exe	38
PID 2376 wrote to memory of 2616	2376	corelX5.exe	38

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2736	attrib.exe
2456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\ffbb51b968abc45197bef0cd465fe72f_JaffaCakes118.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2456
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Deletes itself
    PID:2284
- - C:\Users\Admin\Documents\Corel Draw-X5\corelX5.exe
    "C:\Users\Admin\Documents\Corel Draw-X5\corelX5.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\Documents\Corel Draw-X5\corelX5.exe
      "C:\Users\Admin\Documents\Corel Draw-X5\corelX5.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\Documents\Corel Draw-X5\corelX5.exe

Filesize
283KB

MD5
ffbb51b968abc45197bef0cd465fe72f

SHA1
5d44ac78f2351c3d837ed52bc1b4a75473960ce1

SHA256
29d04b65d7fa77a28a4906a2f0d8c1cee2ab3784cb6cdd4a31d1c4bb8abd09c6

SHA512
dc5532305a2b3e0420a2021656e00b9ca03a31c28503f07e946a2de1bc44256d4649a447dc5ac24d109946f5acf3aa3409e6f564f7dcde1e540e7decc793ee71

Download Submit
memory/1744-10-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-12-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1744-3-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-8-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-11-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-9-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-60-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-2-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1744-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1744-6-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2284-15-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2284-31-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2376-63-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2376-56-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2376-57-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2608-51-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2936-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download