darkcomet | 5ca54747c0b1ce3c39044d66853d0075ce97f5e8be2a330d6be4ebd7e35b5e81

General

Target

5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Size

722KB
MD5

5986d57702bc2c6ffeef297b708c74d8
SHA1

c2dabd2310f2b057b5b9cbb37ea0af10e13abbf9
SHA256

5ca54747c0b1ce3c39044d66853d0075ce97f5e8be2a330d6be4ebd7e35b5e81
SHA512

f948d51bb5f51db6276e2344622867b9a2a595fd38109b86da9ed525751cecec30c025fa3b7f7e1b9af79e97a369f4daf3bc4d6be3bc47aa7ceee7b88cfedb48
SSDEEP

12288:EFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0c/qd:U3nbWmJVJFwSddIXvfhqbiaxvRFqd

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Suspicious use of SetThreadContext 1 IoCs

Processes:

5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe

description pid process target process

PID 2480 set thread context of 2580 2480 5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe iexplore.exe

description	pid	process	target process
PID 2480 set thread context of 2580	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeSecurityPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeBackupPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeRestorePrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeShutdownPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeDebugPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeUndockPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: 33	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: 34	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: 35	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2580	iexplore.exe
Token: SeSecurityPrivilege	2580	iexplore.exe
Token: SeTakeOwnershipPrivilege	2580	iexplore.exe
Token: SeLoadDriverPrivilege	2580	iexplore.exe
Token: SeSystemProfilePrivilege	2580	iexplore.exe
Token: SeSystemtimePrivilege	2580	iexplore.exe
Token: SeProfSingleProcessPrivilege	2580	iexplore.exe
Token: SeIncBasePriorityPrivilege	2580	iexplore.exe
Token: SeCreatePagefilePrivilege	2580	iexplore.exe
Token: SeBackupPrivilege	2580	iexplore.exe
Token: SeRestorePrivilege	2580	iexplore.exe
Token: SeShutdownPrivilege	2580	iexplore.exe
Token: SeDebugPrivilege	2580	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2580	iexplore.exe
Token: SeChangeNotifyPrivilege	2580	iexplore.exe
Token: SeRemoteShutdownPrivilege	2580	iexplore.exe
Token: SeUndockPrivilege	2580	iexplore.exe
Token: SeManageVolumePrivilege	2580	iexplore.exe
Token: SeImpersonatePrivilege	2580	iexplore.exe
Token: SeCreateGlobalPrivilege	2580	iexplore.exe
Token: 33	2580	iexplore.exe
Token: 34	2580	iexplore.exe
Token: 35	2580	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2580 iexplore.exe

pid	process
2580	iexplore.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe

description	pid	process	target process
PID 2480 wrote to memory of 2580	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe	iexplore.exe
PID 2480 wrote to memory of 2580	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe	iexplore.exe
PID 2480 wrote to memory of 2580	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe	iexplore.exe
PID 2480 wrote to memory of 2580	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe	iexplore.exe
PID 2480 wrote to memory of 2580	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe	iexplore.exe
PID 2480 wrote to memory of 2580	2480	5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5986d57702bc2c6ffeef297b708c74d8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2480-2-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2580-1-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing