darkcomet | 62bc25646fb53fb537e5f7df1a22388ddc86acc54b35702bc33780af37eda5ab

General

Target

0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Size

797KB
MD5

0f08c77d123024756eec3a6643bc5a57
SHA1

0baf67971c671ed44fd75c5218188d6ea251bec0
SHA256

62bc25646fb53fb537e5f7df1a22388ddc86acc54b35702bc33780af37eda5ab
SHA512

9df9189f706d958aaf201cac619671e240a08edb63bf83bbd95a22ec9190a69afee9b0fac42b3803aa5c7d5a7103cc2aac79046a94aaf25b038f59e3e5a05bb0
SSDEEP

12288:bFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0c/qe:53nbWmJVJFwSddIXvfhqbiaxvRFqe

Score

10^/10

darkcomet latentbot evasion rat trojan upx

Malware Config

Extracted

Family

latentbot

C2

hiluxtoyota.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2608	attrib.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3040-0-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3040-11-0x0000000000400000-0x00000000004C9000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeSecurityPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeBackupPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeRestorePrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeShutdownPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeUndockPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: 33	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: 34	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
Token: 35	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2488	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe	28
PID 3040 wrote to memory of 2488	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe	28
PID 3040 wrote to memory of 2488	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe	28
PID 3040 wrote to memory of 2488	3040	0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe	28
PID 2488 wrote to memory of 2608	2488	cmd.exe	30
PID 2488 wrote to memory of 2608	2488	cmd.exe	30
PID 2488 wrote to memory of 2608	2488	cmd.exe	30
PID 2488 wrote to memory of 2608	2488	cmd.exe	30

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2608	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\0f08c77d123024756eec3a6643bc5a57_JaffaCakes118.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

Filesize
101B

MD5
0793a6173c7b65d2c96aef8f79a7adfa

SHA1
f60c8855426e0b8e5e86243b96bd5c605502d143

SHA256
6facb6a5ef438b694764cd8a2b25a931cf8932f88392e464864be487a7cc7468

SHA512
d31ddb211cddaa299fb560b141254668ba4a7396af5ad70af930a3ec0c8c31d61a1333e7bed887c746df8a728f1e3556b17940cadf1d9ca2f12e99f9523c0ff4

Download Submit
memory/3040-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3040-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3040-11-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3040-12-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads