darkcomet | f1232a3ce1b7fb19e7c5d24c85dc422ff3114dd74bc40d4095c31f2c55f51949

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Size

756KB
MD5

6167ef56e2d65f200e34f98edd16476c
SHA1

be92e11e579604770fd3c7bbff2eb54872267299
SHA256

f1232a3ce1b7fb19e7c5d24c85dc422ff3114dd74bc40d4095c31f2c55f51949
SHA512

fc1bf9224c804fb01dc2e5c8dc9a1a221a6982f90f9179e234ade790fad0f1a4f9ea4233d627bd6f71efae7d829182071458542326b440b9e758d349ce27bfdd
SSDEEP

12288:F9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hj:PZ1xuVVjfFoynPaVBUR8f+kN10EBx

Score

10^/10

darkcomet guest16 evasion rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

zozorf.hopto.org:1604

Mutex

DC_MUTEX-XNRMK5M

Attributes

gencode
gFFxV3kBcDyT
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Disables Task Manager via registry modification
evasion
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

pid process

4820 6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

pid	process
4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeSecurityPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeBackupPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeRestorePrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeShutdownPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeDebugPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeUndockPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: 33	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: 34	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: 35	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
Token: 36	4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

pid process

4820 6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

pid	process
4820	6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6167ef56e2d65f200e34f98edd16476c_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4820

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4820-0-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/4820-1-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-2-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-3-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-4-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-5-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-6-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-7-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-8-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-9-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-10-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-11-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-12-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-13-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4820-14-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download