darkcomet | 671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7

General

Target

17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Size

915KB
MD5

17204b9a765bf62127f5654c7e76dd1f
SHA1

d8fcec0641580b226394d085be77c5fe1e443a97
SHA256

671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7
SHA512

191eeb0729ad93dc3b35650be3f471e5d6dc8459d7de14a8e83da839400297d733142fbf33193f1ed90aa81d2e92f6adb8d41980c6c5ca46606757dc710945a3
SSDEEP

12288:7w5wNzoYqZtfEJRplx8Y1tcDiYifuMPcWTb0vLwySQ5xH:7BGYkfGzVcDiYimM0DLwySQf

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
Nl2fmspeVP53
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSecurityPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeBackupPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeRestorePrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeShutdownPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeDebugPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeUndockPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 33	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 34	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 35	2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2408	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2408	2384	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-28-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2408-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-24-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-30-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-18-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-14-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-10-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-36-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2408-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2408-21-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-29-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-31-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2408-33-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-32-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-34-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-35-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2408-4-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Analysis

Sharing