darkcomet | 087b218c20f3303d54301ce34d213123e5316cceea76da24e994763470c4e748

General

Target

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Size

658KB
MD5

44f3687352ee192c23dccdcc2a42546b
SHA1

899c40b55791ea111bfe4f147a47bc9018d2da9c
SHA256

087b218c20f3303d54301ce34d213123e5316cceea76da24e994763470c4e748
SHA512

0a523b9c649fd79373e3caedbb45f2039bdecbec7a950df45d16052478beb0f057d43eb29c9a67880a748a6f7d3cbe9b83f6bc3143da43d19f430ba8808cdd72
SSDEEP

12288:i9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h6:OZ1xuVVjfFoynPaVBUR8f+kN10EBE

Score

10^/10

darkcomet kurban rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

kurban

C2

192.168.1.32:1000

Mutex

DC_MUTEX-6LD8PQ5

Attributes

gencode
j2DiyytPhs3R
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Suspicious use of SetThreadContext 1 IoCs

Processes:

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe

description pid process target process

PID 4720 set thread context of 2428 4720 44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe iexplore.exe

description	pid	process	target process
PID 4720 set thread context of 2428	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSecurityPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeBackupPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeRestorePrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeShutdownPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeDebugPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeUndockPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: 33	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: 34	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: 35	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: 36	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2428	iexplore.exe
Token: SeSecurityPrivilege	2428	iexplore.exe
Token: SeTakeOwnershipPrivilege	2428	iexplore.exe
Token: SeLoadDriverPrivilege	2428	iexplore.exe
Token: SeSystemProfilePrivilege	2428	iexplore.exe
Token: SeSystemtimePrivilege	2428	iexplore.exe
Token: SeProfSingleProcessPrivilege	2428	iexplore.exe
Token: SeIncBasePriorityPrivilege	2428	iexplore.exe
Token: SeCreatePagefilePrivilege	2428	iexplore.exe
Token: SeBackupPrivilege	2428	iexplore.exe
Token: SeRestorePrivilege	2428	iexplore.exe
Token: SeShutdownPrivilege	2428	iexplore.exe
Token: SeDebugPrivilege	2428	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2428	iexplore.exe
Token: SeChangeNotifyPrivilege	2428	iexplore.exe
Token: SeRemoteShutdownPrivilege	2428	iexplore.exe
Token: SeUndockPrivilege	2428	iexplore.exe
Token: SeManageVolumePrivilege	2428	iexplore.exe
Token: SeImpersonatePrivilege	2428	iexplore.exe
Token: SeCreateGlobalPrivilege	2428	iexplore.exe
Token: 33	2428	iexplore.exe
Token: 34	2428	iexplore.exe
Token: 35	2428	iexplore.exe
Token: 36	2428	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2428 iexplore.exe

pid	process
2428	iexplore.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe

description	pid	process	target process
PID 4720 wrote to memory of 2428	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 4720 wrote to memory of 2428	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 4720 wrote to memory of 2428	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 4720 wrote to memory of 2428	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe
PID 4720 wrote to memory of 2428	4720	44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44f3687352ee192c23dccdcc2a42546b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4720-0-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/4720-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing