darkcomet | edf7a365e594729cb046b5c335176d52084e818f1784bd7d9b563a8dbad052ad

General

Target

2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe
Size

954KB
MD5

2d9714edff846b0f84a8ee626fd26896
SHA1

a98d6f029c00b5819f25347f4d33d4c0afe0aeaf
SHA256

edf7a365e594729cb046b5c335176d52084e818f1784bd7d9b563a8dbad052ad
SHA512

f7084d99cada324db7e1014b61a872f5cf00a724124cd7371a14ccadf53586bb4ad0348e5a3f886f54e9c4bdb2f5dd56336cdba7e9ec6f515b82888d047c7b65
SSDEEP

24576:fiRfuXiRfeAmBpVKHu0Mu9Xo20VGLVP5ZD0QZh9ux:QmYGAmKZVwx

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

tle0F761600.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\MSDCSC\\msdcsc.exe"	tle0F761600.exe

Executes dropped EXE 2 IoCs

Processes:

tle0F761600.exemsdcsc.exe

pid process

2036 tle0F761600.exe
2108 msdcsc.exe

pid	process
2036	tle0F761600.exe
2108	msdcsc.exe

Loads dropped DLL 4 IoCs

Processes:

2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exetle0F761600.exe

pid	process
1740	2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe
1740	2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe
2036	tle0F761600.exe
2036	tle0F761600.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tle0F761600.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Windows\\MSDCSC\\msdcsc.exe"	tle0F761600.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Windows\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in Windows directory 3 IoCs

Processes:

tle0F761600.exe

description	ioc	process
File opened for modification	C:\Windows\MSDCSC\	tle0F761600.exe
File created	C:\Windows\MSDCSC\msdcsc.exe	tle0F761600.exe
File opened for modification	C:\Windows\MSDCSC\msdcsc.exe	tle0F761600.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2732 PING.EXE

pid	process
2732	PING.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

tle0F761600.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2036	tle0F761600.exe
Token: SeSecurityPrivilege	2036	tle0F761600.exe
Token: SeTakeOwnershipPrivilege	2036	tle0F761600.exe
Token: SeLoadDriverPrivilege	2036	tle0F761600.exe
Token: SeSystemProfilePrivilege	2036	tle0F761600.exe
Token: SeSystemtimePrivilege	2036	tle0F761600.exe
Token: SeProfSingleProcessPrivilege	2036	tle0F761600.exe
Token: SeIncBasePriorityPrivilege	2036	tle0F761600.exe
Token: SeCreatePagefilePrivilege	2036	tle0F761600.exe
Token: SeBackupPrivilege	2036	tle0F761600.exe
Token: SeRestorePrivilege	2036	tle0F761600.exe
Token: SeShutdownPrivilege	2036	tle0F761600.exe
Token: SeDebugPrivilege	2036	tle0F761600.exe
Token: SeSystemEnvironmentPrivilege	2036	tle0F761600.exe
Token: SeChangeNotifyPrivilege	2036	tle0F761600.exe
Token: SeRemoteShutdownPrivilege	2036	tle0F761600.exe
Token: SeUndockPrivilege	2036	tle0F761600.exe
Token: SeManageVolumePrivilege	2036	tle0F761600.exe
Token: SeImpersonatePrivilege	2036	tle0F761600.exe
Token: SeCreateGlobalPrivilege	2036	tle0F761600.exe
Token: 33	2036	tle0F761600.exe
Token: 34	2036	tle0F761600.exe
Token: 35	2036	tle0F761600.exe
Token: SeIncreaseQuotaPrivilege	2108	msdcsc.exe
Token: SeSecurityPrivilege	2108	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2108	msdcsc.exe
Token: SeLoadDriverPrivilege	2108	msdcsc.exe
Token: SeSystemProfilePrivilege	2108	msdcsc.exe
Token: SeSystemtimePrivilege	2108	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2108	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2108	msdcsc.exe
Token: SeCreatePagefilePrivilege	2108	msdcsc.exe
Token: SeBackupPrivilege	2108	msdcsc.exe
Token: SeRestorePrivilege	2108	msdcsc.exe
Token: SeShutdownPrivilege	2108	msdcsc.exe
Token: SeDebugPrivilege	2108	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2108	msdcsc.exe
Token: SeChangeNotifyPrivilege	2108	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2108	msdcsc.exe
Token: SeUndockPrivilege	2108	msdcsc.exe
Token: SeManageVolumePrivilege	2108	msdcsc.exe
Token: SeImpersonatePrivilege	2108	msdcsc.exe
Token: SeCreateGlobalPrivilege	2108	msdcsc.exe
Token: 33	2108	msdcsc.exe
Token: 34	2108	msdcsc.exe
Token: 35	2108	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2108 msdcsc.exe

pid	process
2108	msdcsc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exetle0F761600.execmd.exe

description	pid	process	target process
PID 1740 wrote to memory of 2036	1740	2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe	tle0F761600.exe
PID 1740 wrote to memory of 2036	1740	2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe	tle0F761600.exe
PID 1740 wrote to memory of 2036	1740	2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe	tle0F761600.exe
PID 1740 wrote to memory of 2036	1740	2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe	tle0F761600.exe
PID 2036 wrote to memory of 2108	2036	tle0F761600.exe	msdcsc.exe
PID 2036 wrote to memory of 2108	2036	tle0F761600.exe	msdcsc.exe
PID 2036 wrote to memory of 2108	2036	tle0F761600.exe	msdcsc.exe
PID 2036 wrote to memory of 2108	2036	tle0F761600.exe	msdcsc.exe
PID 2036 wrote to memory of 2616	2036	tle0F761600.exe	cmd.exe
PID 2036 wrote to memory of 2616	2036	tle0F761600.exe	cmd.exe
PID 2036 wrote to memory of 2616	2036	tle0F761600.exe	cmd.exe
PID 2036 wrote to memory of 2616	2036	tle0F761600.exe	cmd.exe
PID 2616 wrote to memory of 2732	2616	cmd.exe	PING.EXE
PID 2616 wrote to memory of 2732	2616	cmd.exe	PING.EXE
PID 2616 wrote to memory of 2732	2616	cmd.exe	PING.EXE
PID 2616 wrote to memory of 2732	2616	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d9714edff846b0f84a8ee626fd26896_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\tle0F761600.exe
C:\Users\Admin\AppData\Local\Temp\tle0F761600.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\MSDCSC\msdcsc.exe
"C:\Windows\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\tle0F761600.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\tle0F761600.exe
Filesize
746KB

MD5
55381d429466565ec99dc43e24b2285c

SHA1
24cb8635cf641fec22b8c3d4790e96ab8e96298d

SHA256
dee3b2b643025ead5fe67543fe324183c4432103ac454f02652ce2f8210fe1af

SHA512
7609f4cd0c98150a5b09fb816e11663539fbd434de9f937c327994cbedb6ec28d49e9b0eca217a4d8aea1bbbbb97525e975bef01f40ceb29ec36f86c576128ba

Download Submit
memory/1740-7-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2036-23-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2036-9-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2108-27-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-30-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-25-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-26-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-22-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2108-28-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-29-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-24-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-31-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-32-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-33-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-34-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-35-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-36-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2108-37-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads