darkcomet | 2fa1ab454114dc94dd69ae6e2f2a31270bd7f00e8ea454317791374a767a3cdf

General

Target
19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Size 649KB
Sample240628-lskphswarp
SHA256 2fa1ab454114dc94dd69ae6e2f2a31270bd7f00e8ea454317791374a767a3cdf
MD5 19ae0c3eba9091ca7daea2db9b5f3f09
SHA1 1e9cf220cccc2155aa0d41ae401d584ebb98863a
SHA512 dd471891a6e439f9babe91dcd10ce60e9d1a9b2857544224fcd94c96d02c72c5c1a1909497c6f7c060f7021405e66b0ecc1395134f604127d9c1d4692db187d5
SSDEEP 12288:bk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+A:Q0QRWoJEfg0oChGdJQbjPbNW5tYeP+G9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet habbo gen evasion rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Habbo Gen

C2

82.41.38.18:1995

Mutex

DC_MUTEX-5WTNQ5D

Attributes

gencode
Qn34A2Y5nQa0
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4112	attrib.exe
872	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSecurityPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeBackupPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeRestorePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeShutdownPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeDebugPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeUndockPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 33	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 34	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 35	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 36	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4604	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	80
PID 2444 wrote to memory of 4604	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	80
PID 2444 wrote to memory of 4604	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	80
PID 2444 wrote to memory of 1984	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	81
PID 2444 wrote to memory of 1984	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	81
PID 2444 wrote to memory of 1984	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	81
PID 4604 wrote to memory of 4112	4604	cmd.exe	84
PID 4604 wrote to memory of 4112	4604	cmd.exe	84
PID 4604 wrote to memory of 4112	4604	cmd.exe	84
PID 1984 wrote to memory of 872	1984	cmd.exe	85
PID 1984 wrote to memory of 872	1984	cmd.exe	85
PID 1984 wrote to memory of 872	1984	cmd.exe	85

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4112	attrib.exe
872	attrib.exe

C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:872