darkcomet | 09c95ba487f26ff77390e9b3c677833ccd73b378d7f0e05e7bd15d568f3cf64b

General

Target

2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe
Size

3.3MB
MD5

2e08760d785ca73395fdb40af2a11df6
SHA1

79f554c1f6124675ba3fde9959d43d01e67775ca
SHA256

09c95ba487f26ff77390e9b3c677833ccd73b378d7f0e05e7bd15d568f3cf64b
SHA512

6845569a8203db430c184ef13daf7055cc97cb0abcdf443dbe45903b23bedccfc01a8602193a19acb9e978ef24f0b1146f5ec1f0dbe826fbe8ecd9568c4d62cb
SSDEEP

49152:5ls8QyAsFPgMmS4/8GbgApQg7XsWBFCxWpPamyu:5ls8KIgW4vTTZ9V/

Score

10^/10

darkcomet rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSecurityPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeTakeOwnershipPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeLoadDriverPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSystemProfilePrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSystemtimePrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeProfSingleProcessPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeIncBasePriorityPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeCreatePagefilePrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeBackupPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeRestorePrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeShutdownPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeDebugPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeSystemEnvironmentPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeChangeNotifyPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeRemoteShutdownPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeUndockPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeManageVolumePrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeImpersonatePrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: SeCreateGlobalPrivilege	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: 33	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: 34	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: 35	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
Token: 36	2624	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87
PID 2360 wrote to memory of 2624	2360	2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
  "C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2624-3-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-2-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-4-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-5-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-6-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-7-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-8-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-9-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-10-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-12-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-13-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download
memory/2624-14-0x0000000000400000-0x000000000098D000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing