darkcomet | a6685af236c51f363e378f5cdeaf03741e9f11c096fcb21155e81ad65a1bc7f5

General

Target

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Size

659KB
MD5

357d567ed2444279986ed2cdc828567f
SHA1

62728068d98e8d10f1d7b99c3344f7b2dd37c90c
SHA256

a6685af236c51f363e378f5cdeaf03741e9f11c096fcb21155e81ad65a1bc7f5
SHA512

30ed6a857f7eaf3e2e0e634dc5e50ac288767ed43bc026502ea259d1594630916c0b5337ab7c1ac9c6d667d953eb16087e4fc8ae9483a8cc3e43eaf70fa6d8e7
SSDEEP

12288:C9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFFo:uiBIGkbxqEcjsWiDxguehC2SR

Score

10^/10

darkcomet lol persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

lol

C2

91.76.157.16:80

91.76.157.16:8888

Mutex

DC_MUTEX-RWPQ37G

Attributes

InstallPath
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
gencode
jKEWAxYjXN8w
install
true
offline_keylogger
true
password
546klcp8888
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe"	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid process

2584 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Loads dropped DLL 2 IoCs

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

pid process

2936 357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
2936 357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

pid	process
2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid	process
2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe"	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSecurityPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeBackupPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeRestorePrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeShutdownPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeDebugPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeUndockPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: 33	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: 34	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: 35	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSecurityPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeTakeOwnershipPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeLoadDriverPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSystemProfilePrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSystemtimePrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeProfSingleProcessPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeIncBasePriorityPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeCreatePagefilePrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeBackupPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeRestorePrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeShutdownPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeDebugPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSystemEnvironmentPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeChangeNotifyPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeRemoteShutdownPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeUndockPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeManageVolumePrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeImpersonatePrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeCreateGlobalPrivilege	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: 33	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: 34	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: 35	2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid process

2584 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid	process
2584	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

description	pid	process	target process
PID 2936 wrote to memory of 2584	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
PID 2936 wrote to memory of 2584	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
PID 2936 wrote to memory of 2584	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
PID 2936 wrote to memory of 2584	2936	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

C:\Users\Admin\AppData\Local\Temp\357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\Documents\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
"C:\Users\Admin\Documents\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\Documents\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Filesize
659KB

MD5
357d567ed2444279986ed2cdc828567f

SHA1
62728068d98e8d10f1d7b99c3344f7b2dd37c90c

SHA256
a6685af236c51f363e378f5cdeaf03741e9f11c096fcb21155e81ad65a1bc7f5

SHA512
30ed6a857f7eaf3e2e0e634dc5e50ac288767ed43bc026502ea259d1594630916c0b5337ab7c1ac9c6d667d953eb16087e4fc8ae9483a8cc3e43eaf70fa6d8e7

Download Submit
memory/2584-11-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2584-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2584-16-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2584-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2936-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2936-13-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads