darkcomet | d778223c7e970c4c45e106284839066d2a7b673addd228341b76b39baa9db070

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bacde978ca1883278695a507d4452be_JaffaCakes118.exe
Size 697KB
Sample240712-c1lr4svemn
SHA256 d778223c7e970c4c45e106284839066d2a7b673addd228341b76b39baa9db070
MD5 3bacde978ca1883278695a507d4452be
SHA1 57e3600b383795914705d0624d2110fd0e4c4865
SHA512 bd11e501aaea365484db535b6069caa23bcfcb7291d4fe981b7f84b0829bc1bef9063de053041e95784c84e616357f53bd76c6d727f3707cdb5b05b7f285e5ad
SSDEEP 12288:mrHE4YobRXThY+Mk1ZUYz0Ze7zPWJH2xsD5rVrt0d+eDfcNQYVXoD686urDb:w34mnUXgUj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

adsa7.no-ip.biz:25565

Mutex

DC_MUTEX-HAAJZA8

Attributes

gencode
hAznTmDF9bTj
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3236-5-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-6-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-8-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-10-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-9-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-13-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-12-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-14-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-15-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-16-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-17-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-18-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-19-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-20-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-21-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-22-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-23-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-24-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-25-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-26-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-27-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-28-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-29-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3236-30-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1zDSnoxI = "C:\\Users\\Admin\\AppData\\Roaming\\3bacde978ca1883278695a507d4452be_JaffaCakes118.exe"	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bacde978ca1883278695a507d4452be_JaffaCakes118.exe"	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96

Kills process with taskkill 9 IoCs

evasion

pid	Process
448	taskkill.exe
2736	taskkill.exe
2340	taskkill.exe
1808	taskkill.exe
1576	taskkill.exe
3052	taskkill.exe
3232	taskkill.exe
1872	taskkill.exe
3336	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe
1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe
1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe
1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3236	vbc.exe
Token: SeSecurityPrivilege	3236	vbc.exe
Token: SeTakeOwnershipPrivilege	3236	vbc.exe
Token: SeLoadDriverPrivilege	3236	vbc.exe
Token: SeSystemProfilePrivilege	3236	vbc.exe
Token: SeSystemtimePrivilege	3236	vbc.exe
Token: SeProfSingleProcessPrivilege	3236	vbc.exe
Token: SeIncBasePriorityPrivilege	3236	vbc.exe
Token: SeCreatePagefilePrivilege	3236	vbc.exe
Token: SeBackupPrivilege	3236	vbc.exe
Token: SeRestorePrivilege	3236	vbc.exe
Token: SeShutdownPrivilege	3236	vbc.exe
Token: SeDebugPrivilege	3236	vbc.exe
Token: SeSystemEnvironmentPrivilege	3236	vbc.exe
Token: SeChangeNotifyPrivilege	3236	vbc.exe
Token: SeRemoteShutdownPrivilege	3236	vbc.exe
Token: SeUndockPrivilege	3236	vbc.exe
Token: SeManageVolumePrivilege	3236	vbc.exe
Token: SeImpersonatePrivilege	3236	vbc.exe
Token: SeCreateGlobalPrivilege	3236	vbc.exe
Token: 33	3236	vbc.exe
Token: 34	3236	vbc.exe
Token: 35	3236	vbc.exe
Token: 36	3236	vbc.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	3232	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeDebugPrivilege	448	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3236	vbc.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4472	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	84
PID 1036 wrote to memory of 4472	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	84
PID 1036 wrote to memory of 4472	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	84
PID 1036 wrote to memory of 2940	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	85
PID 1036 wrote to memory of 2940	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	85
PID 1036 wrote to memory of 2940	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	85
PID 1036 wrote to memory of 908	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	86
PID 1036 wrote to memory of 908	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	86
PID 1036 wrote to memory of 908	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	86
PID 1036 wrote to memory of 2284	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	87
PID 1036 wrote to memory of 2284	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	87
PID 1036 wrote to memory of 2284	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	87
PID 1036 wrote to memory of 2708	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	88
PID 1036 wrote to memory of 2708	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	88
PID 1036 wrote to memory of 2708	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	88
PID 1036 wrote to memory of 2924	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	89
PID 1036 wrote to memory of 2924	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	89
PID 1036 wrote to memory of 2924	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	89
PID 1036 wrote to memory of 720	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	90
PID 1036 wrote to memory of 720	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	90
PID 1036 wrote to memory of 720	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	90
PID 1036 wrote to memory of 4776	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	91
PID 1036 wrote to memory of 4776	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	91
PID 1036 wrote to memory of 4776	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	91
PID 1036 wrote to memory of 1088	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	93
PID 1036 wrote to memory of 1088	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	93
PID 1036 wrote to memory of 1088	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	93
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 1036 wrote to memory of 3236	1036	3bacde978ca1883278695a507d4452be_JaffaCakes118.exe	96
PID 2708 wrote to memory of 2340	2708	cmd.exe	103
PID 2708 wrote to memory of 2340	2708	cmd.exe	103
PID 2708 wrote to memory of 2340	2708	cmd.exe	103
PID 4776 wrote to memory of 1808	4776	cmd.exe	106
PID 4776 wrote to memory of 1808	4776	cmd.exe	106
PID 4776 wrote to memory of 1808	4776	cmd.exe	106
PID 4472 wrote to memory of 1872	4472	cmd.exe	104
PID 4472 wrote to memory of 1872	4472	cmd.exe	104
PID 4472 wrote to memory of 1872	4472	cmd.exe	104
PID 720 wrote to memory of 3232	720	cmd.exe	105
PID 720 wrote to memory of 3232	720	cmd.exe	105
PID 720 wrote to memory of 3232	720	cmd.exe	105
PID 2940 wrote to memory of 1576	2940	cmd.exe	110
PID 2940 wrote to memory of 1576	2940	cmd.exe	110
PID 2940 wrote to memory of 1576	2940	cmd.exe	110
PID 1088 wrote to memory of 3336	1088	cmd.exe	107
PID 1088 wrote to memory of 3336	1088	cmd.exe	107
PID 1088 wrote to memory of 3336	1088	cmd.exe	107
PID 908 wrote to memory of 2736	908	cmd.exe	108
PID 908 wrote to memory of 2736	908	cmd.exe	108
PID 908 wrote to memory of 2736	908	cmd.exe	108
PID 2924 wrote to memory of 3052	2924	cmd.exe	109
PID 2924 wrote to memory of 3052	2924	cmd.exe	109
PID 2924 wrote to memory of 3052	2924	cmd.exe	109
PID 2284 wrote to memory of 448	2284	cmd.exe	111
PID 2284 wrote to memory of 448	2284	cmd.exe	111
PID 2284 wrote to memory of 448	2284	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\3bacde978ca1883278695a507d4452be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bacde978ca1883278695a507d4452be_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im Fiddler.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Fiddler.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im procexp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im procexp64.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im Tcpview.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Tcpview.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im SbieCtrl.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SbieCtrl.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im Start.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Start.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im SandboxieRpcSs.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SandboxieRpcSs.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im SandboxieDcomLaunch.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SandboxieDcomLaunch.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im SbieSvc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SbieSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-11-0x0000000074C90000-0x0000000075241000-memory.dmp

Download

memory/1036-1-0x0000000074C90000-0x0000000075241000-memory.dmp

Download

memory/1036-2-0x0000000074C90000-0x0000000075241000-memory.dmp

Download

memory/1036-0-0x0000000074C92000-0x0000000074C93000-memory.dmp

Download

memory/3236-17-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-18-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-12-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-14-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-6-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-15-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-5-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-19-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-20-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-21-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-22-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-23-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-24-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-25-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-26-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-27-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-28-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-29-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3236-30-0x0000000000400000-0x00000000004BA000-memory.dmp

Download