darkcomet | 9de73fa2272d0672a1d303c2fc49680840975230e81bebca99298fd8f46dcc8a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe
Size

965KB
MD5

239005e9b8a18bad6153e29c0640cd0b
SHA1

9bc4ae68f12cebd6082b6fadb0931db5dfd8ff48
SHA256

9de73fa2272d0672a1d303c2fc49680840975230e81bebca99298fd8f46dcc8a
SHA512

75a8dea24a53a657c706d8532c3f92e2b2ec3af7e267eb2c0b7dffc2630c44c9c5b372bf4f551ce8f1fa430ffaf48966636090f50f8aa382f9041d72d35c270f
SSDEEP

12288:Q2cOTobWl24WN01cTFCZibqd/VJoVE3JMEjRy2riDRmTEXr/WFX/kWs2uq73J4rk:QhTFCiq7JoVa5jRyRmgzt275oX+LR

Score

10^/10

darkcomet guest16_min rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

127.0.0.1:1604

Mutex

DCMIN_MUTEX-2C0GF0Q

Attributes

gencode
FeliwHF7p039
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

lol.exe

pid process

4800 lol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4800	lol.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

lol.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4800	lol.exe
Token: SeSecurityPrivilege	4800	lol.exe
Token: SeTakeOwnershipPrivilege	4800	lol.exe
Token: SeLoadDriverPrivilege	4800	lol.exe
Token: SeSystemProfilePrivilege	4800	lol.exe
Token: SeSystemtimePrivilege	4800	lol.exe
Token: SeProfSingleProcessPrivilege	4800	lol.exe
Token: SeIncBasePriorityPrivilege	4800	lol.exe
Token: SeCreatePagefilePrivilege	4800	lol.exe
Token: SeBackupPrivilege	4800	lol.exe
Token: SeRestorePrivilege	4800	lol.exe
Token: SeShutdownPrivilege	4800	lol.exe
Token: SeDebugPrivilege	4800	lol.exe
Token: SeSystemEnvironmentPrivilege	4800	lol.exe
Token: SeChangeNotifyPrivilege	4800	lol.exe
Token: SeRemoteShutdownPrivilege	4800	lol.exe
Token: SeUndockPrivilege	4800	lol.exe
Token: SeManageVolumePrivilege	4800	lol.exe
Token: SeImpersonatePrivilege	4800	lol.exe
Token: SeCreateGlobalPrivilege	4800	lol.exe
Token: 33	4800	lol.exe
Token: 34	4800	lol.exe
Token: 35	4800	lol.exe
Token: 36	4800	lol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

lol.exe

pid process

4800 lol.exe

pid	process
4800	lol.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe

description	pid	process	target process
PID 5112 wrote to memory of 4800	5112	239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe	lol.exe
PID 5112 wrote to memory of 4800	5112	239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe	lol.exe
PID 5112 wrote to memory of 4800	5112	239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe	lol.exe

C:\Users\Admin\AppData\Local\Temp\239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\239005e9b8a18bad6153e29c0640cd0b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\lol.exe
"C:\Users\Admin\AppData\Local\Temp\lol.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4800

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lol.exe
Filesize
659KB

MD5
2def27b950f8175bd96a8d237d4c3f40

SHA1
852b4338e4324712616e6fe0325b749c14156cfb

SHA256
977c382efb1a252481ceb4490fd673b29e988a6e01d22eed09ec6f06ef5039ef

SHA512
c6340e1ae0e9cb009eb283dcaadc0d887fa598acf698cf234c002698b135c9b279606bed37236e58b57d268b65d1bdba6c8ce857361504539899eb855d3daf49

Download Submit
memory/4800-26-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-24-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-32-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-30-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-20-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-17-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-28-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-27-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4800-16-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4800-23-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/5112-19-0x0000000075252000-0x0000000075253000-memory.dmp

Filesize
4KB

Download
memory/5112-0-0x0000000075252000-0x0000000075253000-memory.dmp

Filesize
4KB

Download
memory/5112-18-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/5112-2-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/5112-1-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/5112-4-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download