darkcomet | a6685af236c51f363e378f5cdeaf03741e9f11c096fcb21155e81ad65a1bc7f5

General

Target

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Size

659KB
MD5

357d567ed2444279986ed2cdc828567f
SHA1

62728068d98e8d10f1d7b99c3344f7b2dd37c90c
SHA256

a6685af236c51f363e378f5cdeaf03741e9f11c096fcb21155e81ad65a1bc7f5
SHA512

30ed6a857f7eaf3e2e0e634dc5e50ac288767ed43bc026502ea259d1594630916c0b5337ab7c1ac9c6d667d953eb16087e4fc8ae9483a8cc3e43eaf70fa6d8e7
SSDEEP

12288:C9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFFo:uiBIGkbxqEcjsWiDxguehC2SR

Score

10^/10

darkcomet lol persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

lol

C2

91.76.157.16:80

91.76.157.16:8888

Mutex

DC_MUTEX-RWPQ37G

Attributes

InstallPath
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
gencode
jKEWAxYjXN8w
install
true
offline_keylogger
true
password
546klcp8888
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe"	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid process

4844 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid	process
4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe"	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSecurityPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeBackupPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeRestorePrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeShutdownPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeDebugPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeUndockPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: 33	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: 34	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: 35	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: 36	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSecurityPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeTakeOwnershipPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeLoadDriverPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSystemProfilePrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSystemtimePrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeProfSingleProcessPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeIncBasePriorityPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeCreatePagefilePrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeBackupPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeRestorePrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeShutdownPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeDebugPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeSystemEnvironmentPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeChangeNotifyPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeRemoteShutdownPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeUndockPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeManageVolumePrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeImpersonatePrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: SeCreateGlobalPrivilege	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: 33	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: 34	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: 35	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Token: 36	4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid process

4844 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

pid	process
4844	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe

description	pid	process	target process
PID 3300 wrote to memory of 4844	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
PID 3300 wrote to memory of 4844	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
PID 3300 wrote to memory of 4844	3300	357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe

C:\Users\Admin\AppData\Local\Temp\357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\357d567ed2444279986ed2cdc828567f_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300

C:\Users\Admin\Documents\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
"C:\Users\Admin\Documents\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Filesize
659KB

MD5
357d567ed2444279986ed2cdc828567f

SHA1
62728068d98e8d10f1d7b99c3344f7b2dd37c90c

SHA256
a6685af236c51f363e378f5cdeaf03741e9f11c096fcb21155e81ad65a1bc7f5

SHA512
30ed6a857f7eaf3e2e0e634dc5e50ac288767ed43bc026502ea259d1594630916c0b5337ab7c1ac9c6d667d953eb16087e4fc8ae9483a8cc3e43eaf70fa6d8e7

Download Submit
memory/3300-0-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/3300-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4844-13-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4844-15-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4844-17-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4844-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads