darkcomet | 671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7

General

Target

17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Size

915KB
MD5

17204b9a765bf62127f5654c7e76dd1f
SHA1

d8fcec0641580b226394d085be77c5fe1e443a97
SHA256

671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7
SHA512

191eeb0729ad93dc3b35650be3f471e5d6dc8459d7de14a8e83da839400297d733142fbf33193f1ed90aa81d2e92f6adb8d41980c6c5ca46606757dc710945a3
SSDEEP

12288:7w5wNzoYqZtfEJRplx8Y1tcDiYifuMPcWTb0vLwySQ5xH:7BGYkfGzVcDiYimM0DLwySQf

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
Nl2fmspeVP53
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3972 set thread context of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSecurityPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeBackupPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeRestorePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeShutdownPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeDebugPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeUndockPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 33	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 34	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 35	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 36	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3972-11-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/4184-15-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4184-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-12-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-14-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-6-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-4-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-10-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-16-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Analysis

Sharing