darkcomet | 9e50a70c88dbd95315dc29fed727a95f661ee726713f164331c05eb402570d5e

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Size

756KB
MD5

5b8bcbe274f61685651cb6531b97cff0
SHA1

1da88984536a0bb2564b992b44fc70d79bebf1ab
SHA256

9e50a70c88dbd95315dc29fed727a95f661ee726713f164331c05eb402570d5e
SHA512

4826e01e1c8f42921866ab7a47432fecba6db02098fa315c04d45558162ca8fa69f7d347cd6f0ded08953225c221f1b8df195f1644272c9549b6f426a0ad896a
SSDEEP

12288:r9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h6bZRK:lZ1xuVVjfFoynPaVBUR8f+kN10EB2ZRK

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-N5SDY2F

Attributes

gencode
DiAWCkcfySvM
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeSecurityPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeSystemtimePrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeBackupPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeRestorePrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeShutdownPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeDebugPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeUndockPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeManageVolumePrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeImpersonatePrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: 33	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: 34	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
Token: 35	836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe

pid process

836 5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe

pid	process
836	5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b8bcbe274f61685651cb6531b97cff0_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/836-1-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/836-2-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/836-3-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/836-4-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/836-7-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/836-8-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download