darkcomet | 639528ba0d2f206cdcf4df6f4aa9c533c899726435c21c67a8398ae989361649

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe
Size 636KB
Sample240716-3haj8sybpc
SHA256 639528ba0d2f206cdcf4df6f4aa9c533c899726435c21c67a8398ae989361649
MD5 5085bf6efd8c1a0d8ae451cb98ceb589
SHA1 275d83429e06e91c4807be278454849223fc910e
SHA512 4205db904ed4786038e1b460e394cbbd9b76064dc4cd9181707493c508d34f2ae16481e7c80a32f23e8b36386c7934d5a16213bea19842d740dabc81db506c11
SSDEEP 12288:FK3D4laOy90Oa4MFHCo7hGnreTq1759piuMJJHw8DFJBG:0VOyjZo70N1jpnMXwl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	Exporer32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Exporer32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	Exporer32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	deee.exe

Executes dropped EXE 4 IoCs

pid	Process
4168	deee.exe
2396	Exporer32.exe
232	BAFFOT~1.EXE
2348	winupdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	Exporer32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Exporer32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Exporer32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Exporer32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Exporer32.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	Exporer32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2396	Exporer32.exe
Token: SeSecurityPrivilege	2396	Exporer32.exe
Token: SeTakeOwnershipPrivilege	2396	Exporer32.exe
Token: SeLoadDriverPrivilege	2396	Exporer32.exe
Token: SeSystemProfilePrivilege	2396	Exporer32.exe
Token: SeSystemtimePrivilege	2396	Exporer32.exe
Token: SeProfSingleProcessPrivilege	2396	Exporer32.exe
Token: SeIncBasePriorityPrivilege	2396	Exporer32.exe
Token: SeCreatePagefilePrivilege	2396	Exporer32.exe
Token: SeBackupPrivilege	2396	Exporer32.exe
Token: SeRestorePrivilege	2396	Exporer32.exe
Token: SeShutdownPrivilege	2396	Exporer32.exe
Token: SeDebugPrivilege	2396	Exporer32.exe
Token: SeSystemEnvironmentPrivilege	2396	Exporer32.exe
Token: SeChangeNotifyPrivilege	2396	Exporer32.exe
Token: SeRemoteShutdownPrivilege	2396	Exporer32.exe
Token: SeUndockPrivilege	2396	Exporer32.exe
Token: SeManageVolumePrivilege	2396	Exporer32.exe
Token: SeImpersonatePrivilege	2396	Exporer32.exe
Token: SeCreateGlobalPrivilege	2396	Exporer32.exe
Token: 33	2396	Exporer32.exe
Token: 34	2396	Exporer32.exe
Token: 35	2396	Exporer32.exe
Token: 36	2396	Exporer32.exe
Token: SeIncreaseQuotaPrivilege	2348	winupdate.exe
Token: SeSecurityPrivilege	2348	winupdate.exe
Token: SeTakeOwnershipPrivilege	2348	winupdate.exe
Token: SeLoadDriverPrivilege	2348	winupdate.exe
Token: SeSystemProfilePrivilege	2348	winupdate.exe
Token: SeSystemtimePrivilege	2348	winupdate.exe
Token: SeProfSingleProcessPrivilege	2348	winupdate.exe
Token: SeIncBasePriorityPrivilege	2348	winupdate.exe
Token: SeCreatePagefilePrivilege	2348	winupdate.exe
Token: SeBackupPrivilege	2348	winupdate.exe
Token: SeRestorePrivilege	2348	winupdate.exe
Token: SeShutdownPrivilege	2348	winupdate.exe
Token: SeDebugPrivilege	2348	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2348	winupdate.exe
Token: SeChangeNotifyPrivilege	2348	winupdate.exe
Token: SeRemoteShutdownPrivilege	2348	winupdate.exe
Token: SeUndockPrivilege	2348	winupdate.exe
Token: SeManageVolumePrivilege	2348	winupdate.exe
Token: SeImpersonatePrivilege	2348	winupdate.exe
Token: SeCreateGlobalPrivilege	2348	winupdate.exe
Token: 33	2348	winupdate.exe
Token: 34	2348	winupdate.exe
Token: 35	2348	winupdate.exe
Token: 36	2348	winupdate.exe
Token: 33	1172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1172	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4168	deee.exe
2348	winupdate.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4168	3328	5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe	83
PID 3328 wrote to memory of 4168	3328	5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe	83
PID 3328 wrote to memory of 4168	3328	5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe	83
PID 4168 wrote to memory of 2396	4168	deee.exe	87
PID 4168 wrote to memory of 2396	4168	deee.exe	87
PID 4168 wrote to memory of 2396	4168	deee.exe	87
PID 3328 wrote to memory of 232	3328	5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe	88
PID 3328 wrote to memory of 232	3328	5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe	88
PID 3328 wrote to memory of 232	3328	5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe	88
PID 2396 wrote to memory of 1508	2396	Exporer32.exe	89
PID 2396 wrote to memory of 1508	2396	Exporer32.exe	89
PID 2396 wrote to memory of 1508	2396	Exporer32.exe	89
PID 2396 wrote to memory of 2348	2396	Exporer32.exe	90
PID 2396 wrote to memory of 2348	2396	Exporer32.exe	90
PID 2396 wrote to memory of 2348	2396	Exporer32.exe	90

C:\Users\Admin\AppData\Local\Temp\5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5085bf6efd8c1a0d8ae451cb98ceb589_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\deee.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\deee.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
    "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      PID:1508
  - - C:\Windupdt\winupdate.exe
      "C:\Windupdt\winupdate.exe"
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2348
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BAFFOT~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BAFFOT~1.EXE
  2⤵
  - Executes dropped EXE
  PID:232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Exporer32.exe

Path C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
Size 250KB
SHA256 c50cc9a938230e13f96e7015cdbdfbbe15aadbf1e8142d8face86042cef7ee6d
MD5 b79442dafc69a6ac050d185c28131c12
SHA1 ab98fd623d80708e16460086ab163cf5bfa8df91
SHA512 8d486407c38083970d1685826f0e882b62a4bfbeb0c38865f8879ffd13d48fac6dc634ebb1ec05d7a9a8b34c9e4152d2e5cd250f8083baf3ed8e424f9d8f0b31
SSDEEP 6144:dHjwI7RoBjoQ4Qhb1YFFjk96QnNq/D0YE:tjwAR0748bGFpk96QwTE
MD5 SHA1 SHA512 SSDEEP

Submit Download

BAFFOT~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BAFFOT~1.EXE
Size 426KB
SHA256 98f8f34de1f1ac542e1b8d7fb98d52ef605c581adf690738509e31fd7fd28923
MD5 9e8ab8c593ceb8196f3703623d26a8f4
SHA1 5e01c7c46ae584def8488f56d7d17cf4aed79c60
SHA512 ae0a45b7ccee974a9f521521c7319607eb4e23c02a35a290ec1cee0c2a44110f165446ea773e6c858dd995d3ca94f53212570b8b8349d87502efc211d9843c3f
SSDEEP 6144:dY71eudi4U9YHxmRws9/sEhZCw18PvP1M/CRA78UlPfCyogIavb1qFfmkl+Gy366:iB1dhwvRL0S8PgXCyzI8b1qFes+Gy366
MD5 SHA1 SHA512 SSDEEP

Submit Download

deee.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\deee.exe
Size 263KB
SHA256 8004595e27ed20cd1b51c0edb4715bb377a4189b35268831a1ec847448a9e2af
MD5 5c5db1ac9d84c0e34a2ce18d1ac3f5cc
SHA1 58af15646a3f6696cd4b468c90ff9f5c76ee3e5c
SHA512 f3d18e423e993204e8af24fc95daee0d51f60c5febc051d222457f3bbb8b6f3763826c68c6ea3ec3b84caff9beee57c0ec65c952965180277cbde33dd8aa2777
SSDEEP 6144:rpRzTEQzbOU1KePhG0bXe/RzXY1iqG2PsRLEj:T/9zbThhG0relIREEj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2348-39-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-37-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-32-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-33-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-34-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-35-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-36-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-45-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-38-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-44-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-40-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-41-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-42-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2348-43-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2396-16-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2396-31-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads