darkcomet | 0b00dfb0fb1c119a2dc6dd80e78208b65e7ddebde5e58309dcf4a2c6c8b0b87d

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Size

834KB
MD5

14f5a72d76df3c4b3d922f521d76924b
SHA1

277c3d949f9d1c30b31fbe3748a2ecd69b6b140b
SHA256

0b00dfb0fb1c119a2dc6dd80e78208b65e7ddebde5e58309dcf4a2c6c8b0b87d
SHA512

271396ec216d15257a0e91e3f9a4776e42172cec95fd5f5f84387996ddd9dafc409000a5e3b9d5bc097a7270375ca60625649af4e098547dcf4a307aca5f100e
SSDEEP

24576:toEzLIjXPKMe68j+eTnYSK/cRgOnmq9g6R5/NF:toSIjfKjLjgRcOU7m6RvF

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-5RWBU5Z

Attributes

gencode
eK3b82cACp3o
install
false
offline_keylogger
true
password
moumene
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

description	pid	process	target process
PID 4000 set thread context of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSecurityPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeBackupPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeRestorePrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeShutdownPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeDebugPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeUndockPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: 33	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: 34	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: 35	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
Token: 36	1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

pid process

4000 14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
1372 14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

pid	process
4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
1372	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

description	pid	process	target process
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
PID 4000 wrote to memory of 1372	4000	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe	14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000

C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14f5a72d76df3c4b3d922f521d76924b_JaffaCakes118.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:5008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-91-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-88-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-86-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-85-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-84-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1372-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4000-61-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-70-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-2-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/4000-9-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-10-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-12-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-13-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-14-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-15-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-16-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-18-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-17-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-20-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-19-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-21-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-23-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-24-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-26-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-27-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-25-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-28-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-29-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-30-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-32-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-34-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-37-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-40-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-44-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-47-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-51-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-56-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-3-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/4000-66-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-73-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-74-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-72-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-71-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-8-0x0000000003D40000-0x0000000003E40000-memory.dmp

Filesize
1024KB

Download
memory/4000-69-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-68-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-67-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-65-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-64-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-63-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-62-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-60-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-59-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-58-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-57-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-55-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-54-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-53-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-52-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-50-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-49-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-48-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-46-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-45-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-43-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-42-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-41-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-39-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-38-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-36-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-35-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-33-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-31-0x0000000003D40000-0x0000000003FF5000-memory.dmp

Filesize
2.7MB

Download
memory/4000-4-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/4000-5-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/4000-6-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/4000-7-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/4000-1-0x0000000002C40000-0x0000000002CA0000-memory.dmp

Filesize
384KB

Download
memory/4000-0-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/4000-75-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/4000-78-0x0000000002C40000-0x0000000002CA0000-memory.dmp

Filesize
384KB

Download
memory/4000-77-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download