darkcomet | f493057440e28d88dac057c92b21b47a6e729fbaf19e8fe4374a23793a5df755

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe
Size 2.3MB
Sample240716-m3t7dayglp
SHA256 f493057440e28d88dac057c92b21b47a6e729fbaf19e8fe4374a23793a5df755
MD5 4e024fc6077966c9fb8f801e2458705c
SHA1 4910b5b23ebed9e4d0070c28bddc67ea695500ad
SHA512 2645a9e2075b7ca24ed8e21c2eb5650996567fa41b2e5d1427995681b54503a134278ad4b74396638541b69f164e1b0f7d1ee86f5167bfc5ab7a9564cb86f0bb
SSDEEP 49152:cp38U0o7Mi6oFuGYvqZn8MAA2li6Pu+QO806XA7gf:zU0o76QuVvAn8rA29u+bBg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet victim persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Victim

omgg.no-ip.biz:1337

Mutex

DC_MUTEX-RNDVBHX

Attributes

gencode
0lcHSKv3xC16
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 3 IoCs

pid	Process
744	WinUpd.exe
1948	vbc.exe
3172	WINRAR~2.EXE

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdtr = "C:\\Users\\Admin\\AppData\\Roaming\\WinUpdtr\\WinUpd.exe"	WinUpd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 744 set thread context of 1948	744	WinUpd.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1948	vbc.exe
Token: SeSecurityPrivilege	1948	vbc.exe
Token: SeTakeOwnershipPrivilege	1948	vbc.exe
Token: SeLoadDriverPrivilege	1948	vbc.exe
Token: SeSystemProfilePrivilege	1948	vbc.exe
Token: SeSystemtimePrivilege	1948	vbc.exe
Token: SeProfSingleProcessPrivilege	1948	vbc.exe
Token: SeIncBasePriorityPrivilege	1948	vbc.exe
Token: SeCreatePagefilePrivilege	1948	vbc.exe
Token: SeBackupPrivilege	1948	vbc.exe
Token: SeRestorePrivilege	1948	vbc.exe
Token: SeShutdownPrivilege	1948	vbc.exe
Token: SeDebugPrivilege	1948	vbc.exe
Token: SeSystemEnvironmentPrivilege	1948	vbc.exe
Token: SeChangeNotifyPrivilege	1948	vbc.exe
Token: SeRemoteShutdownPrivilege	1948	vbc.exe
Token: SeUndockPrivilege	1948	vbc.exe
Token: SeManageVolumePrivilege	1948	vbc.exe
Token: SeImpersonatePrivilege	1948	vbc.exe
Token: SeCreateGlobalPrivilege	1948	vbc.exe
Token: 33	1948	vbc.exe
Token: 34	1948	vbc.exe
Token: 35	1948	vbc.exe
Token: 36	1948	vbc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1948	vbc.exe
3172	WINRAR~2.EXE
3172	WINRAR~2.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 744	4880	4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe	83
PID 4880 wrote to memory of 744	4880	4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe	83
PID 4880 wrote to memory of 744	4880	4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe	83
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 744 wrote to memory of 1948	744	WinUpd.exe	88
PID 4880 wrote to memory of 3172	4880	4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe	89
PID 4880 wrote to memory of 3172	4880	4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e024fc6077966c9fb8f801e2458705c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WinUpd.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WinUpd.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\vbc.exe
    C:\Users\Admin\AppData\Local\Temp\vbc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1948
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINRAR~2.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINRAR~2.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WINRAR~2.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINRAR~2.EXE
Size 1.5MB
SHA256 1703c2c8754c9c1857e3ac1ab399badc1085e7a288007e58348e0e74b677b42e
MD5 18198f0d8d195bfe22edbdc78ae3c227
SHA1 efa8f7aa0484a73d0a0a3195a9a7f231adb4c993
SHA512 25b51d78eee52da53a4249b5f8e81c2f8d8021c40472c9bebc14dae10d3e1712df02b23ceda10639e973456bc81079d609c7b9f359a153a44d63e847e31e7986
SSDEEP 24576:2NQhmG6PbGCwhM3Co6nwYEBtg2jJ+uIPA798fIl3B8Rgho6/ApaKbb:2NGmlebnwXLg2l+FP2y6B8x6/Apaob
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinUpd.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WinUpd.exe
Size 1.1MB
SHA256 3479b4ed13ab536a3dbc07581dbdf549fd474ec5949d339e40bc3ee97c99bc31
MD5 9e325f527842c3eb0cbd714f6afadf73
SHA1 fe0dabd8e0c72823a2fa0defd8063a1e6561fafe
SHA512 5e82c23652c37a157d96a19901b02b1d9f5d67c2a4d2d8a539deb5fba4c531e4d48e9d1f9de97050c05bd520f6eb49853a5ec76f84dc03b6b6682111dbf77438
SSDEEP 24576:UTeiJE6C7pChJZl85LRj8tnqAoEb7pUaz+WhSJj65g:U76pChyLt8BoapUa7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe

Path C:\Users\Admin\AppData\Local\Temp\vbc.exe
Size 1.1MB
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
SSDEEP 24576:jp2silPBMIXGWClfuRcUGIJYK15Qs/QZM:jp2sMO7VzUTJH15QFZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/744-20-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/744-7-0x0000000074C62000-0x0000000074C63000-memory.dmp

Download

memory/744-8-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/744-9-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/1948-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-34-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-19-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-29-0x0000000074C10000-0x0000000075218000-memory.dmp

Download

memory/1948-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-33-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-35-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-36-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-37-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-38-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-39-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-40-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-41-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1948-43-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads