darkcomet | 68c0d475fb078732cf86958be4cf5fef95a8f949e7f81af60c50b76b29ff68e1

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f494c8906c3b72f23e7577034d6c09e_JaffaCakes118.exe
Size 632KB
Sample240702-pdb1ls1flc
SHA256 68c0d475fb078732cf86958be4cf5fef95a8f949e7f81af60c50b76b29ff68e1
MD5 1f494c8906c3b72f23e7577034d6c09e
SHA1 4ef0001f7197430e0da9a73c2542695f4deb3eaa
SHA512 9cfc450390413dff74f2818f7b68db4790b2918d6a6e3c72a5a19822c6a021df483ea6526a0ea9f7452b3946d5962471db594c43f2eb536b6500225485df797a
SSDEEP 12288:m3H14ByetSUTYV06NRksRnXjuyPWAbLIeCLhOi1wr0wjaGqAmBI:8mBtJZ68OfGd1NsgI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2064	attrib.exe
2484	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	1f494c8906c3b72f23e7577034d6c09e_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
60	winini.exe
4420	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe"	winini.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 60 set thread context of 4420	60	winini.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4420	svchost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	60	winini.exe
Token: SeIncreaseQuotaPrivilege	4420	svchost.exe
Token: SeSecurityPrivilege	4420	svchost.exe
Token: SeTakeOwnershipPrivilege	4420	svchost.exe
Token: SeLoadDriverPrivilege	4420	svchost.exe
Token: SeSystemProfilePrivilege	4420	svchost.exe
Token: SeSystemtimePrivilege	4420	svchost.exe
Token: SeProfSingleProcessPrivilege	4420	svchost.exe
Token: SeIncBasePriorityPrivilege	4420	svchost.exe
Token: SeCreatePagefilePrivilege	4420	svchost.exe
Token: SeBackupPrivilege	4420	svchost.exe
Token: SeRestorePrivilege	4420	svchost.exe
Token: SeShutdownPrivilege	4420	svchost.exe
Token: SeDebugPrivilege	4420	svchost.exe
Token: SeSystemEnvironmentPrivilege	4420	svchost.exe
Token: SeChangeNotifyPrivilege	4420	svchost.exe
Token: SeRemoteShutdownPrivilege	4420	svchost.exe
Token: SeUndockPrivilege	4420	svchost.exe
Token: SeManageVolumePrivilege	4420	svchost.exe
Token: SeImpersonatePrivilege	4420	svchost.exe
Token: SeCreateGlobalPrivilege	4420	svchost.exe
Token: 33	4420	svchost.exe
Token: 34	4420	svchost.exe
Token: 35	4420	svchost.exe
Token: 36	4420	svchost.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 60	4412	1f494c8906c3b72f23e7577034d6c09e_JaffaCakes118.exe	81
PID 4412 wrote to memory of 60	4412	1f494c8906c3b72f23e7577034d6c09e_JaffaCakes118.exe	81
PID 4412 wrote to memory of 60	4412	1f494c8906c3b72f23e7577034d6c09e_JaffaCakes118.exe	81
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 60 wrote to memory of 4420	60	winini.exe	82
PID 4420 wrote to memory of 984	4420	svchost.exe	83
PID 4420 wrote to memory of 984	4420	svchost.exe	83
PID 4420 wrote to memory of 984	4420	svchost.exe	83
PID 4420 wrote to memory of 3364	4420	svchost.exe	85
PID 4420 wrote to memory of 3364	4420	svchost.exe	85
PID 4420 wrote to memory of 3364	4420	svchost.exe	85
PID 984 wrote to memory of 2064	984	cmd.exe	87
PID 984 wrote to memory of 2064	984	cmd.exe	87
PID 984 wrote to memory of 2064	984	cmd.exe	87
PID 3364 wrote to memory of 2484	3364	cmd.exe	88
PID 3364 wrote to memory of 2484	3364	cmd.exe	88
PID 3364 wrote to memory of 2484	3364	cmd.exe	88

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2064	attrib.exe
2484	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1f494c8906c3b72f23e7577034d6c09e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f494c8906c3b72f23e7577034d6c09e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\winini.exe
  "C:\Users\Admin\AppData\Local\Temp\winini.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\svchost.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 34KB
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
SSDEEP 768:Paq4bp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdn5y85p3:ud4+KTMVJHmMsEBKdn5vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

winini.exe

Path C:\Users\Admin\AppData\Local\Temp\winini.exe
Size 468KB
SHA256 c643dd96b2d6ea85f4312d48b0c6baa85285482b62aaa120e46dc7b273484e47
MD5 d2d0bb29802c887afe67eed287381b5d
SHA1 e03c31c529215a776c1bca43c751730e6de4de34
SHA512 157d9c5b3072822edc66f0155ce918a91115714c75731b90c195df58d94ff6c090233d50b1311876d0330a0c176acfbfa82edfb081d70d202c6228a07744a80b
SSDEEP 12288:NZWLiJ6ATwdalMn1S6UFI/IC0JG2eid6cC2L8qa:iLw1In1SVJJG21uAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-29-0x0000000074860000-0x0000000074E11000-memory.dmp

Download

memory/60-17-0x0000000074860000-0x0000000074E11000-memory.dmp

Download

memory/60-18-0x0000000074860000-0x0000000074E11000-memory.dmp

Download

memory/60-16-0x0000000074860000-0x0000000074E11000-memory.dmp

Download

memory/4412-2-0x0000000074860000-0x0000000074E11000-memory.dmp

Download

memory/4412-15-0x0000000074860000-0x0000000074E11000-memory.dmp

Download

memory/4412-0-0x0000000074862000-0x0000000074863000-memory.dmp

Download

memory/4412-1-0x0000000074860000-0x0000000074E11000-memory.dmp

Download

memory/4420-28-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-31-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-25-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-21-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-34-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-33-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-32-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-26-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-30-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/4420-35-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-37-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-39-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-41-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-42-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-44-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4420-46-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads