darkcomet | 09c95ba487f26ff77390e9b3c677833ccd73b378d7f0e05e7bd15d568f3cf64b

General

Target

2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe
Size

3.3MB
MD5

2e08760d785ca73395fdb40af2a11df6
SHA1

79f554c1f6124675ba3fde9959d43d01e67775ca
SHA256

09c95ba487f26ff77390e9b3c677833ccd73b378d7f0e05e7bd15d568f3cf64b
SHA512

6845569a8203db430c184ef13daf7055cc97cb0abcdf443dbe45903b23bedccfc01a8602193a19acb9e978ef24f0b1146f5ec1f0dbe826fbe8ecd9568c4d62cb
SSDEEP

49152:5ls8QyAsFPgMmS4/8GbgApQg7XsWBFCxWpPamyu:5ls8KIgW4vTTZ9V/

Score

10^/10

darkcomet rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSecurityPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeTakeOwnershipPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeLoadDriverPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSystemProfilePrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSystemtimePrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeProfSingleProcessPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeIncBasePriorityPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeCreatePagefilePrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeBackupPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeRestorePrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeShutdownPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeDebugPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSystemEnvironmentPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeChangeNotifyPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeRemoteShutdownPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeUndockPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeManageVolumePrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeImpersonatePrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeCreateGlobalPrivilege	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: 33	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: 34	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: 35	2708	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28
PID 1292 wrote to memory of 2708	1292	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
  "C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-10-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-12-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-22-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-23-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-16-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-8-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-4-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-20-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2708-14-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-7-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-2-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-24-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-21-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-25-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-26-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2708-28-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing