darkcomet | 9653e203f43c0a3cbe9b49e6ee77f1a5621017205c107dcc9c72f31a7157ecb4

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe
Size 1.0MB
Sample240715-ea546swfrj
SHA256 9653e203f43c0a3cbe9b49e6ee77f1a5621017205c107dcc9c72f31a7157ecb4
MD5 48143dc6e9cbf182672cdba8737def18
SHA1 f65f75fadc6667e272b73429c4c2d747070a5ac1
SHA512 586c2a5d57790da592db3c464808ede770f026c619667e36219ce7e2a9bd453d55d0b245d5fa1fc381216127fdb44a2c551b5caf18e8e1145d83e49ac8c039af
SSDEEP 12288:JcIfTMo0qe2kekoVgvn8dVnjXxjJZBzLwMDjHJlsDxCR2Te7Bn3UGifR:Jjooa2kYVEmVJZBzkwll2xCwe7Bn39A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
268	ǭǥȄƪƕ.exe
5012	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MsMpEng.exe"	ǭǥȄƪƕ.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	5012	svchost.exe
Token: SeSecurityPrivilege	5012	svchost.exe
Token: SeTakeOwnershipPrivilege	5012	svchost.exe
Token: SeLoadDriverPrivilege	5012	svchost.exe
Token: SeSystemProfilePrivilege	5012	svchost.exe
Token: SeSystemtimePrivilege	5012	svchost.exe
Token: SeProfSingleProcessPrivilege	5012	svchost.exe
Token: SeIncBasePriorityPrivilege	5012	svchost.exe
Token: SeCreatePagefilePrivilege	5012	svchost.exe
Token: SeBackupPrivilege	5012	svchost.exe
Token: SeRestorePrivilege	5012	svchost.exe
Token: SeShutdownPrivilege	5012	svchost.exe
Token: SeDebugPrivilege	5012	svchost.exe
Token: SeSystemEnvironmentPrivilege	5012	svchost.exe
Token: SeChangeNotifyPrivilege	5012	svchost.exe
Token: SeRemoteShutdownPrivilege	5012	svchost.exe
Token: SeUndockPrivilege	5012	svchost.exe
Token: SeManageVolumePrivilege	5012	svchost.exe
Token: SeImpersonatePrivilege	5012	svchost.exe
Token: SeCreateGlobalPrivilege	5012	svchost.exe
Token: 33	5012	svchost.exe
Token: 34	5012	svchost.exe
Token: 35	5012	svchost.exe
Token: 36	5012	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5012	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4588	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	86
PID 636 wrote to memory of 4588	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	86
PID 636 wrote to memory of 4588	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	86
PID 4588 wrote to memory of 4892	4588	csc.exe	88
PID 4588 wrote to memory of 4892	4588	csc.exe	88
PID 4588 wrote to memory of 4892	4588	csc.exe	88
PID 636 wrote to memory of 268	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	89
PID 636 wrote to memory of 268	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	89
PID 636 wrote to memory of 268	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	89
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90
PID 636 wrote to memory of 5012	636	48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48143dc6e9cbf182672cdba8737def18_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qkp5xs_b.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC015.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC014.tmp"
    3⤵
    PID:4892
- C:\Users\Admin\AppData\Local\Temp\ǭǥȄƪƕ.exe
  "C:\Users\Admin\AppData\Local\Temp\ǭǥȄƪƕ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:268
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC015.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC015.tmp
Size 1KB
SHA256 98e68e1e507402dbabf4a6d12e035a1364089da28283c4bfc62b1ef56f349cf5
MD5 f2af215df5565ad55e792b1bfdd80418
SHA1 355041894196a79974e07a9d2fc1d45aa464b35e
SHA512 c5dac78a32249e8899690be28d234fc645024b02342e88c9c44a19b2b7c450a56ce6160df3a1a5b0ee5092b97d5720ab9c6356a1b69cc034fe1fd698d9ebc3e2
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 34KB
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
SSDEEP 768:Paq4bp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdn5y85p3:ud4+KTMVJHmMsEBKdn5vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ǭǥȄƪƕ.exe

Path C:\Users\Admin\AppData\Local\Temp\ǭǥȄƪƕ.exe
Size 4KB
SHA256 b51732a9c8468dba5d56d9243ae59291a8f222edfa088b2bbac64805c28ceba9
MD5 7f8410cdb762bee76eb21a558f9753b0
SHA1 c629c7de8b0239b5d3c65c5af3ed9c074a9b54a8
SHA512 2ed7b0042d421fe66c3b33ca0e14cdcfb6c2748248dbea90ba0829a4b0ddfd4d348e843d66ac3f14cc750c59851416e95c254d20ab9d4b212d71b091ada7afa2
MD5 SHA1 SHA512

Submit Download

CSCC014.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCC014.tmp
Size 636B
SHA256 96bb214da3e235fc16db9f73f183c53c0aa63ebc52e28d490c078d288b3ed023
MD5 54ab4580d9dc9ee82ac1300152dfc92f
SHA1 90b0df86e8b4d7685d5fb3f68d86fcebed9af942
SHA512 a9eda4451983dcdd1414cbd425520c1723f0124eb70b5f2c2d5711029f895c12f566ef559f9aece17bd13ab6cc3c852a15664b5d58761e3013e35c4107ca83a9
MD5 SHA1 SHA512

Submit Download

qkp5xs_b.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qkp5xs_b.0.cs
Size 1KB
SHA256 a9404fe4962d9481a7859042bbea271843bc7544e41e3ecda7e2d16205067270
MD5 151ed18f6d458b34c443641d98610fec
SHA1 ec9fc2154b46734cd36fb082cb71500334d7dc2c
SHA512 42cf085dc7ed606e66862ff2a4c8a22eaf49eef7cf5ce6a03e68a66475ad54367ddf90e710c33da6f7064408af60f37d9e6cec0f2c0e7d4ef5ff296626cfaff3
MD5 SHA1 SHA512

Submit Download

qkp5xs_b.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qkp5xs_b.cmdline
Size 263B
SHA256 8ff7d2951fdff8f46d5fd07588a5cc9d9b8f20d9b51d9fa49cb8acb74b9e20da
MD5 2e666fb9467360ccb312f882a3c3e3a8
SHA1 19642fb2deb1ada5892d5eef2f598bce798dbc17
SHA512 12808e188538f90112f9b99bc324222c4e2d6f303439234f1c52836de93543ddbe5084d1e590f8e76bbf0ceabdf61cbe82d6500fe3ccfd384281e4043175843b
MD5 SHA1 SHA512

Submit Download

memory/268-21-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/268-28-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/268-38-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/268-24-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/636-35-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/636-1-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/636-0-0x0000000075042000-0x0000000075043000-memory.dmp

Download

memory/4588-7-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/4588-14-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/5012-33-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-41-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-31-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-29-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-32-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-22-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-36-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-37-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-27-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-39-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-40-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-34-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-42-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-43-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-44-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-45-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-46-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-47-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-48-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-49-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5012-50-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads