darkcomet | 24613547a278ce6ed31ff2e6a7fa1670270b8036a8e01ea48d8eb7a5d853f738

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe
Size 729KB
Sample240715-tk67jsydrr
SHA256 24613547a278ce6ed31ff2e6a7fa1670270b8036a8e01ea48d8eb7a5d853f738
MD5 4a68a899ea478121796a9cf04e6cee10
SHA1 297948164d8143a1fb4301635c6419aea709557d
SHA512 6e12ec18d2731f14a462aeb709687a6c24e68ef1149d14e15e6a105f794125f2101c27dc5ddc953633d898679a707e6a39cd8b40054df4861fe3a3884bea81cc
SSDEEP 12288:F6pcYG3CaNsjvG1LxoQyfboIArpoyoQaW7G4JDZYtg4gp3jG2cTAq3DWYCm:eBUJhrqF5oDDi/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe"	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe"	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe"	vbc.exe

Executes dropped EXE 3 IoCs

pid	Process
3408	Writer.exe
4244	Writer.exe
3892	Writer.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3424-5-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3424-7-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3424-9-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3424-10-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3424-25-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3424-23-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2016-38-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2016-41-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4640-48-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4640-49-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4640-61-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\writer = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\writer = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\writer = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Writer.exe"	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 3408 set thread context of 2016	3408	Writer.exe	89
PID 4244 set thread context of 4640	4244	Writer.exe	96

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3340	PING.EXE
1752	PING.EXE
3228	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3424	vbc.exe
Token: SeSecurityPrivilege	3424	vbc.exe
Token: SeTakeOwnershipPrivilege	3424	vbc.exe
Token: SeLoadDriverPrivilege	3424	vbc.exe
Token: SeSystemProfilePrivilege	3424	vbc.exe
Token: SeSystemtimePrivilege	3424	vbc.exe
Token: SeProfSingleProcessPrivilege	3424	vbc.exe
Token: SeIncBasePriorityPrivilege	3424	vbc.exe
Token: SeCreatePagefilePrivilege	3424	vbc.exe
Token: SeBackupPrivilege	3424	vbc.exe
Token: SeRestorePrivilege	3424	vbc.exe
Token: SeShutdownPrivilege	3424	vbc.exe
Token: SeDebugPrivilege	3424	vbc.exe
Token: SeSystemEnvironmentPrivilege	3424	vbc.exe
Token: SeChangeNotifyPrivilege	3424	vbc.exe
Token: SeRemoteShutdownPrivilege	3424	vbc.exe
Token: SeUndockPrivilege	3424	vbc.exe
Token: SeManageVolumePrivilege	3424	vbc.exe
Token: SeImpersonatePrivilege	3424	vbc.exe
Token: SeCreateGlobalPrivilege	3424	vbc.exe
Token: 33	3424	vbc.exe
Token: 34	3424	vbc.exe
Token: 35	3424	vbc.exe
Token: 36	3424	vbc.exe
Token: SeIncreaseQuotaPrivilege	2016	vbc.exe
Token: SeSecurityPrivilege	2016	vbc.exe
Token: SeTakeOwnershipPrivilege	2016	vbc.exe
Token: SeLoadDriverPrivilege	2016	vbc.exe
Token: SeSystemProfilePrivilege	2016	vbc.exe
Token: SeSystemtimePrivilege	2016	vbc.exe
Token: SeProfSingleProcessPrivilege	2016	vbc.exe
Token: SeIncBasePriorityPrivilege	2016	vbc.exe
Token: SeCreatePagefilePrivilege	2016	vbc.exe
Token: SeBackupPrivilege	2016	vbc.exe
Token: SeRestorePrivilege	2016	vbc.exe
Token: SeShutdownPrivilege	2016	vbc.exe
Token: SeDebugPrivilege	2016	vbc.exe
Token: SeSystemEnvironmentPrivilege	2016	vbc.exe
Token: SeChangeNotifyPrivilege	2016	vbc.exe
Token: SeRemoteShutdownPrivilege	2016	vbc.exe
Token: SeUndockPrivilege	2016	vbc.exe
Token: SeManageVolumePrivilege	2016	vbc.exe
Token: SeImpersonatePrivilege	2016	vbc.exe
Token: SeCreateGlobalPrivilege	2016	vbc.exe
Token: 33	2016	vbc.exe
Token: 34	2016	vbc.exe
Token: 35	2016	vbc.exe
Token: 36	2016	vbc.exe
Token: SeIncreaseQuotaPrivilege	4640	vbc.exe
Token: SeSecurityPrivilege	4640	vbc.exe
Token: SeTakeOwnershipPrivilege	4640	vbc.exe
Token: SeLoadDriverPrivilege	4640	vbc.exe
Token: SeSystemProfilePrivilege	4640	vbc.exe
Token: SeSystemtimePrivilege	4640	vbc.exe
Token: SeProfSingleProcessPrivilege	4640	vbc.exe
Token: SeIncBasePriorityPrivilege	4640	vbc.exe
Token: SeCreatePagefilePrivilege	4640	vbc.exe
Token: SeBackupPrivilege	4640	vbc.exe
Token: SeRestorePrivilege	4640	vbc.exe
Token: SeShutdownPrivilege	4640	vbc.exe
Token: SeDebugPrivilege	4640	vbc.exe
Token: SeSystemEnvironmentPrivilege	4640	vbc.exe
Token: SeChangeNotifyPrivilege	4640	vbc.exe
Token: SeRemoteShutdownPrivilege	4640	vbc.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3424	5032	4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe	85
PID 3424 wrote to memory of 3408	3424	vbc.exe	86
PID 3424 wrote to memory of 3408	3424	vbc.exe	86
PID 3424 wrote to memory of 3408	3424	vbc.exe	86
PID 3424 wrote to memory of 3248	3424	vbc.exe	87
PID 3424 wrote to memory of 3248	3424	vbc.exe	87
PID 3424 wrote to memory of 3248	3424	vbc.exe	87
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 3408 wrote to memory of 2016	3408	Writer.exe	89
PID 2016 wrote to memory of 4244	2016	vbc.exe	90
PID 2016 wrote to memory of 4244	2016	vbc.exe	90
PID 2016 wrote to memory of 4244	2016	vbc.exe	90
PID 2016 wrote to memory of 2124	2016	vbc.exe	91
PID 2016 wrote to memory of 2124	2016	vbc.exe	91
PID 2016 wrote to memory of 2124	2016	vbc.exe	91
PID 3248 wrote to memory of 3340	3248	cmd.exe	94
PID 3248 wrote to memory of 3340	3248	cmd.exe	94
PID 3248 wrote to memory of 3340	3248	cmd.exe	94
PID 2124 wrote to memory of 1752	2124	cmd.exe	95
PID 2124 wrote to memory of 1752	2124	cmd.exe	95
PID 2124 wrote to memory of 1752	2124	cmd.exe	95
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4244 wrote to memory of 4640	4244	Writer.exe	96
PID 4640 wrote to memory of 3892	4640	vbc.exe	97
PID 4640 wrote to memory of 3892	4640	vbc.exe	97
PID 4640 wrote to memory of 3892	4640	vbc.exe	97
PID 4640 wrote to memory of 3332	4640	vbc.exe	99
PID 4640 wrote to memory of 3332	4640	vbc.exe	99
PID 4640 wrote to memory of 3332	4640	vbc.exe	99
PID 3332 wrote to memory of 3228	3332	cmd.exe	101
PID 3332 wrote to memory of 3228	3332	cmd.exe	101
PID 3332 wrote to memory of 3228	3332	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe
    "C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      4⤵
      Modifies WinLogon for persistence
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe
        
        "C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4244
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        6⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe
        
        "C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe"
        7⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        8⤵
        Runs ping.exe
        
        PID:3228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        6⤵
        Runs ping.exe
        
        PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\4a68a899ea478121796a9cf04e6cee10_JaffaCakes118.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      Runs ping.exe
      PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Writer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Writer.exe.log
Size 116B
SHA256 ecb300191d0e3420d114338ed6850afa649b270f75c181ffe86b435420100870
MD5 fbcc48ddf361df41da6b0400718841f8
SHA1 b6d3641dc3c8186662f3906a350e355f47e373e3
SHA512 1d9d8e3335423152e7b19bc3b0ac8f04d318c342cfeb1567b9b82f0dde0e3d3f57c3fb7c312fbca7d9f46ba2383f32a2abc90df9a924f27da43f854bd490e578
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\ok
Size 47B
SHA256 d009a9aeedf5e513400cc29d1fb14c7d12a675912aff50ac76e150c7362572ea
MD5 905c8e354de83686de79170e025e6e03
SHA1 1daeb6dec2289b09e827440b1bc1aee5d51770f8
SHA512 a9e245d31f93271afcc61b07bb44e343d4a22c12fdfc068308b18a19c60b46b9dbbef78f85d54b3940ed691720391d5e129d5dfb2c12d286d9e415db1510687f
MD5 SHA1 SHA512

Submit Download

Writer.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe
Size 729KB
SHA256 24613547a278ce6ed31ff2e6a7fa1670270b8036a8e01ea48d8eb7a5d853f738
MD5 4a68a899ea478121796a9cf04e6cee10
SHA1 297948164d8143a1fb4301635c6419aea709557d
SHA512 6e12ec18d2731f14a462aeb709687a6c24e68ef1149d14e15e6a105f794125f2101c27dc5ddc953633d898679a707e6a39cd8b40054df4861fe3a3884bea81cc
SSDEEP 12288:F6pcYG3CaNsjvG1LxoQyfboIArpoyoQaW7G4JDZYtg4gp3jG2cTAq3DWYCm:eBUJhrqF5oDDi/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Writer.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\Writer.exe
Size 1.1MB
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
SSDEEP 24576:jp2silPBMIXGWClfuRcUGIJYK15Qs/QZM:jp2sMO7VzUTJH15QFZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2016-41-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/2016-38-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3408-27-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Download

memory/3408-39-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Download

memory/3408-32-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Download

memory/3408-24-0x0000000074AF2000-0x0000000074AF3000-memory.dmp

Download

memory/3424-9-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3424-23-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3424-25-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3424-10-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3424-7-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3424-5-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/4640-48-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/4640-49-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/4640-61-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/5032-26-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Download

memory/5032-0-0x0000000074AF2000-0x0000000074AF3000-memory.dmp

Download

memory/5032-2-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Download

memory/5032-1-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads