darkcomet | 671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7

General

Target

17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Size

915KB
MD5

17204b9a765bf62127f5654c7e76dd1f
SHA1

d8fcec0641580b226394d085be77c5fe1e443a97
SHA256

671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7
SHA512

191eeb0729ad93dc3b35650be3f471e5d6dc8459d7de14a8e83da839400297d733142fbf33193f1ed90aa81d2e92f6adb8d41980c6c5ca46606757dc710945a3
SSDEEP

12288:7w5wNzoYqZtfEJRplx8Y1tcDiYifuMPcWTb0vLwySQ5xH:7BGYkfGzVcDiYimM0DLwySQf

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
Nl2fmspeVP53
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

description	pid	process	target process
PID 3972 set thread context of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSecurityPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeBackupPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeRestorePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeShutdownPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeDebugPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeUndockPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 33	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 34	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 35	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
Token: 36	4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

pid process

4184 17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

pid	process
4184	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

description	pid	process	target process
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
PID 3972 wrote to memory of 4184	3972	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe	17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3972-11-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/4184-15-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4184-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-12-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-14-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-6-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-4-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-10-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4184-16-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads