darkcomet | f6853db269b45d6d925567ea24fc06b3d892bcfe4f9667c491841843ed1d97bf

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Size

283KB
MD5

3c2c9be898e9ee315fb6e2c2b2733f74
SHA1

336dbdcd935817ece8637d1fe95fe8b8b82c9f9b
SHA256

f6853db269b45d6d925567ea24fc06b3d892bcfe4f9667c491841843ed1d97bf
SHA512

e78844734c9d3f38310ded82ca68f8800d42ef8380e4d3dd3a53a9d2d06618873dec0d2e947032cdcbc2976d73dfc5998f9941a74e2760cdc1eb38ef6340d247
SSDEEP

6144:vcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0POQ:vcWkbgTYWnYnt/IDYhPD

Score

10^/10

darkcomet savva rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Savva

127.0.0.1:1604

Mutex

DC_MUTEX-G1V8GJG

Attributes

gencode
lauUBEfLNLxL
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3192-0-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3192-2-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3192-3-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3192-4-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3192-6-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3192-9-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3192-10-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3192-12-0x0000000000400000-0x00000000004C6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeSecurityPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeBackupPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeRestorePrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeShutdownPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeDebugPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeUndockPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: 33	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: 34	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: 35	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
Token: 36	3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe

pid process

3192 3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe

pid	process
3192	3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c2c9be898e9ee315fb6e2c2b2733f74_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3192

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3192-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3192-1-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/3192-2-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3192-3-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3192-4-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3192-6-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3192-9-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3192-10-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3192-12-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download