darkcomet | 4c828e297acd84caf86521a646b8ce561d7947a959ceb2b16bc4ec51c109fd9c

General

Target

21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe
Size

312KB
MD5

21993bae91a9f191d7ca6e94f742a82d
SHA1

6dc84ac779ac3371ab56cc68d53284d6418aca68
SHA256

4c828e297acd84caf86521a646b8ce561d7947a959ceb2b16bc4ec51c109fd9c
SHA512

803ff89f88b1a9612a0bf660bd5d2fa56eef0f5fc6ca1cad4fd8901db321d0eeb468fb79f127e89f23f49d6481f6efb4c85f3d7dbfc5cbdafe580c65a709eac9
SSDEEP

6144:Mi4HfwxTKCCHblh5sJPZGCTfs3nBmPWMG5O/bU3LQGpQ7GbRFyJFD:6/aGL5KPIAMnDVc/gbL3b/yP

Score

10^/10

darkcomet latentbot essential666 persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Essential666

C2

ztwerfdgdhfjkkl.zapto.org:1607

Mutex

DC_MUTEX-R1W1G2U

Attributes

gencode
dLcTwLSyWqCP
install
false
offline_keylogger
true
persistence
false

Extracted

Family

latentbot

C2

ztwerfdgdhfjkkl.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Executes dropped EXE 1 IoCs

pid	Process
2680	cmdl32.exe

Loads dropped DLL 2 IoCs

pid	Process
1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe
1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-55-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-61-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-60-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-48-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-62-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-64-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-63-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-67-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2860-66-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmdl32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmdl32.exe A"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2680 set thread context of 2860	2680	cmdl32.exe	33

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2860	cmdl32.exe
Token: SeSecurityPrivilege	2860	cmdl32.exe
Token: SeTakeOwnershipPrivilege	2860	cmdl32.exe
Token: SeLoadDriverPrivilege	2860	cmdl32.exe
Token: SeSystemProfilePrivilege	2860	cmdl32.exe
Token: SeSystemtimePrivilege	2860	cmdl32.exe
Token: SeProfSingleProcessPrivilege	2860	cmdl32.exe
Token: SeIncBasePriorityPrivilege	2860	cmdl32.exe
Token: SeCreatePagefilePrivilege	2860	cmdl32.exe
Token: SeBackupPrivilege	2860	cmdl32.exe
Token: SeRestorePrivilege	2860	cmdl32.exe
Token: SeShutdownPrivilege	2860	cmdl32.exe
Token: SeDebugPrivilege	2860	cmdl32.exe
Token: SeSystemEnvironmentPrivilege	2860	cmdl32.exe
Token: SeChangeNotifyPrivilege	2860	cmdl32.exe
Token: SeRemoteShutdownPrivilege	2860	cmdl32.exe
Token: SeUndockPrivilege	2860	cmdl32.exe
Token: SeManageVolumePrivilege	2860	cmdl32.exe
Token: SeImpersonatePrivilege	2860	cmdl32.exe
Token: SeCreateGlobalPrivilege	2860	cmdl32.exe
Token: 33	2860	cmdl32.exe
Token: 34	2860	cmdl32.exe
Token: 35	2860	cmdl32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe
2680	cmdl32.exe
2860	cmdl32.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2736	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2736	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2736	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2736	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2680	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2680	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2680	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2680	1740	21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe	32
PID 2736 wrote to memory of 2924	2736	cmd.exe	31
PID 2736 wrote to memory of 2924	2736	cmd.exe	31
PID 2736 wrote to memory of 2924	2736	cmd.exe	31
PID 2736 wrote to memory of 2924	2736	cmd.exe	31
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33
PID 2680 wrote to memory of 2860	2680	cmdl32.exe	33

C:\Users\Admin\AppData\Local\Temp\21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\process.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run" /v cmdl32.exe /d "C:\Users\Admin\AppData\Local\Temp\cmdl32.exe A" /f
    3⤵
    - Adds Run key to start application
    PID:2924
- C:\Users\Admin\AppData\Local\Temp\cmdl32.exe
  C:\Users\Admin\AppData\Local\Temp\cmdl32.exe A
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\cmdl32.exe
    "C:\Windows\system32\cmdl32.exe "
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cmdl32.exe

Filesize
312KB

MD5
21993bae91a9f191d7ca6e94f742a82d

SHA1
6dc84ac779ac3371ab56cc68d53284d6418aca68

SHA256
4c828e297acd84caf86521a646b8ce561d7947a959ceb2b16bc4ec51c109fd9c

SHA512
803ff89f88b1a9612a0bf660bd5d2fa56eef0f5fc6ca1cad4fd8901db321d0eeb468fb79f127e89f23f49d6481f6efb4c85f3d7dbfc5cbdafe580c65a709eac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\process.cmd

Filesize
142B

MD5
7283c41980dba8296dbcec49b3404c5c

SHA1
d53e3109ff2568c34155dc558afed8d9e474e6ab

SHA256
2f63b8cffb95cd05c1c274cb2ce84fa0b9777f5b3b8be490ef90931692aa29f2

SHA512
360f750187b1734ee21fb16829ad194599a480fca48526a3cebddd086d641e4fff417ebb6ff4ab1db7be4f4835e0b05cea08f8c8f127ae05cf2b2b9d5964e85d

Download Submit
memory/1740-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2680-50-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/2860-32-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-61-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-60-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2860-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-48-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-62-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-64-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-63-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-65-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2860-67-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-66-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2860-68-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads