darkcomet | 087b218c20f3303d54301ce34d213123e5316cceea76da24e994763470c4e748

General

Target

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Size

658KB
MD5

44f3687352ee192c23dccdcc2a42546b
SHA1

899c40b55791ea111bfe4f147a47bc9018d2da9c
SHA256

087b218c20f3303d54301ce34d213123e5316cceea76da24e994763470c4e748
SHA512

0a523b9c649fd79373e3caedbb45f2039bdecbec7a950df45d16052478beb0f057d43eb29c9a67880a748a6f7d3cbe9b83f6bc3143da43d19f430ba8808cdd72
SSDEEP

12288:i9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h6:OZ1xuVVjfFoynPaVBUR8f+kN10EBE

Score

10^/10

darkcomet kurban rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

kurban

C2

192.168.1.32:1000

Mutex

DC_MUTEX-6LD8PQ5

Attributes

gencode
j2DiyytPhs3R
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Suspicious use of SetThreadContext 1 IoCs

Processes:

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe

description pid process target process

PID 2224 set thread context of 2820 2224 44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe iexplore.exe

description	pid	process	target process
PID 2224 set thread context of 2820	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSecurityPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeBackupPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeRestorePrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeShutdownPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeDebugPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeUndockPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: 33	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: 34	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: 35	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2820	iexplore.exe
Token: SeSecurityPrivilege	2820	iexplore.exe
Token: SeTakeOwnershipPrivilege	2820	iexplore.exe
Token: SeLoadDriverPrivilege	2820	iexplore.exe
Token: SeSystemProfilePrivilege	2820	iexplore.exe
Token: SeSystemtimePrivilege	2820	iexplore.exe
Token: SeProfSingleProcessPrivilege	2820	iexplore.exe
Token: SeIncBasePriorityPrivilege	2820	iexplore.exe
Token: SeCreatePagefilePrivilege	2820	iexplore.exe
Token: SeBackupPrivilege	2820	iexplore.exe
Token: SeRestorePrivilege	2820	iexplore.exe
Token: SeShutdownPrivilege	2820	iexplore.exe
Token: SeDebugPrivilege	2820	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2820	iexplore.exe
Token: SeChangeNotifyPrivilege	2820	iexplore.exe
Token: SeRemoteShutdownPrivilege	2820	iexplore.exe
Token: SeUndockPrivilege	2820	iexplore.exe
Token: SeManageVolumePrivilege	2820	iexplore.exe
Token: SeImpersonatePrivilege	2820	iexplore.exe
Token: SeCreateGlobalPrivilege	2820	iexplore.exe
Token: 33	2820	iexplore.exe
Token: 34	2820	iexplore.exe
Token: 35	2820	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2820 iexplore.exe

pid	process
2820	iexplore.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe

description	pid	process	target process
PID 2224 wrote to memory of 2820	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 2224 wrote to memory of 2820	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 2224 wrote to memory of 2820	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 2224 wrote to memory of 2820	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 2224 wrote to memory of 2820	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 2224 wrote to memory of 2820	2224	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2224-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2820-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing