darkcomet | f596cc3ee3d53376fc24f363d50c51210e381c8d60f02ebc08f56681afd72ea6

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Size

658KB
MD5

1b16b12d3173fc7d9e367af488934fb4
SHA1

fae4f74602773f66ae574e5adedb43fff66c28d6
SHA256

f596cc3ee3d53376fc24f363d50c51210e381c8d60f02ebc08f56681afd72ea6
SHA512

c5460ad9f848c5442aa5b36ef988c5c4d4d318cbe4dde3d34f4485060950a95f38233b5ceef7dffb62ba738ecd8c0a6ea51c99cfd699307d8b629717d0925c7f
SSDEEP

12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h/:WZ1xuVVjfFoynPaVBUR8f+kN10EB5

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

95.215.254.97:1604

Mutex

DC_MUTEX-5F4P2ZS

Attributes

gencode
CHwp4Gq604H6
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeSecurityPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeBackupPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeRestorePrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeShutdownPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeDebugPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeUndockPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: 33	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: 34	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: 35	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
Token: 36	1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe

pid process

1936 1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe

pid	process
1936	1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b16b12d3173fc7d9e367af488934fb4_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1936-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1936-3-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download