darkcomet | 0b00dfb0fb1c119a2dc6dd80e78208b65e7ddebde5e58309dcf4a2c6c8b0b87d

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Size

834KB
MD5

14f5a72d76df3c4b3d922f521d76924b
SHA1

277c3d949f9d1c30b31fbe3748a2ecd69b6b140b
SHA256

0b00dfb0fb1c119a2dc6dd80e78208b65e7ddebde5e58309dcf4a2c6c8b0b87d
SHA512

271396ec216d15257a0e91e3f9a4776e42172cec95fd5f5f84387996ddd9dafc409000a5e3b9d5bc097a7270375ca60625649af4e098547dcf4a307aca5f100e
SSDEEP

24576:toEzLIjXPKMe68j+eTnYSK/cRgOnmq9g6R5/NF:toSIjfKjLjgRcOU7m6RvF

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-5RWBU5Z

Attributes

gencode
eK3b82cACp3o
install
false
offline_keylogger
true
password
moumene
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

description	pid	process	target process
PID 2268 set thread context of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSecurityPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeBackupPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeRestorePrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeShutdownPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeDebugPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeUndockPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: 33	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: 34	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: 35	2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

pid process

2268 14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
2608 14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

pid	process
2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
2608	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-74-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-24-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-7-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/2268-6-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/2268-5-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/2268-4-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/2268-3-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/2268-2-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2268-8-0x0000000003800000-0x0000000003900000-memory.dmp

Filesize
1024KB

Download
memory/2268-10-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-11-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-12-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-13-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-16-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-15-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-14-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-33-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-32-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-31-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-30-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-29-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-28-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-34-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-69-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-26-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-35-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-25-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-36-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-37-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-68-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-23-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-22-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-21-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-38-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-39-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-40-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-45-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-48-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-47-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-65-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-27-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-0-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/2268-49-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-78-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/2268-77-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download
memory/2268-75-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-73-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-71-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-70-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-67-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-66-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-64-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-63-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-62-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-61-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-60-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-59-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-58-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-57-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-56-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-55-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-54-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-53-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-52-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-51-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-50-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-1-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download
memory/2268-46-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-44-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-43-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-42-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-41-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-20-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-19-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-17-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2268-84-0x0000000003800000-0x0000000003AB5000-memory.dmp

Filesize
2.7MB

Download
memory/2608-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-92-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-95-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

description	pid	process	target process
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 2268 wrote to memory of 2608	2268	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe