darkcomet | c0d60354f5ab983f7d3cadc96d2b9b28467524617ab1e9be23d6a705921fc969

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6037995835a785a752639476e649a992_JaffaCakes118.exe
Size 946KB
Sample240720-2ch4rayalb
SHA256 c0d60354f5ab983f7d3cadc96d2b9b28467524617ab1e9be23d6a705921fc969
MD5 6037995835a785a752639476e649a992
SHA1 a37c182ca65dd6a22d76b702268766df9132cdf3
SHA512 b0f941bd36e6c1810b2e91348cc2b50888f5ca2c3b6335315003f390416eeb277b9c9533f04373cafad06afa192ce81f2c93f37bdf931a9cc3d47d514d05e0fd
SSDEEP 12288:e+37m01mnQaRQ6Zirxrq2Eh8xwkl8E4w5huat7UovONzbXw7:e3dNQ6Ae2Eh8tdhHwNzbXk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet zombi evasion rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Zombi

ozowarac.no-ip.org:1604

Mutex

DC_MUTEX-TF3J9AX

Attributes

gencode
7zTW8Ld2Lb3z
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4412	attrib.exe
2160	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6037995835a785a752639476e649a992_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	server.exe

Executes dropped EXE 2 IoCs

pid	Process
2312	PATCH.exe
1068	server.exe

Loads dropped DLL 1 IoCs

pid	Process
2312	PATCH.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234a1-24.dat	upx
behavioral2/memory/1068-27-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-36-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-37-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-38-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-39-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-40-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-41-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-42-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-43-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-44-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-45-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-46-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-47-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-48-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-49-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1068-50-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1068	server.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	6037995835a785a752639476e649a992_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	1068	server.exe
Token: SeSecurityPrivilege	1068	server.exe
Token: SeTakeOwnershipPrivilege	1068	server.exe
Token: SeLoadDriverPrivilege	1068	server.exe
Token: SeSystemProfilePrivilege	1068	server.exe
Token: SeSystemtimePrivilege	1068	server.exe
Token: SeProfSingleProcessPrivilege	1068	server.exe
Token: SeIncBasePriorityPrivilege	1068	server.exe
Token: SeCreatePagefilePrivilege	1068	server.exe
Token: SeBackupPrivilege	1068	server.exe
Token: SeRestorePrivilege	1068	server.exe
Token: SeShutdownPrivilege	1068	server.exe
Token: SeDebugPrivilege	1068	server.exe
Token: SeSystemEnvironmentPrivilege	1068	server.exe
Token: SeChangeNotifyPrivilege	1068	server.exe
Token: SeRemoteShutdownPrivilege	1068	server.exe
Token: SeUndockPrivilege	1068	server.exe
Token: SeManageVolumePrivilege	1068	server.exe
Token: SeImpersonatePrivilege	1068	server.exe
Token: SeCreateGlobalPrivilege	1068	server.exe
Token: 33	1068	server.exe
Token: 34	1068	server.exe
Token: 35	1068	server.exe
Token: 36	1068	server.exe
Token: 33	4584	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4584	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	server.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2312	1116	6037995835a785a752639476e649a992_JaffaCakes118.exe	84
PID 1116 wrote to memory of 2312	1116	6037995835a785a752639476e649a992_JaffaCakes118.exe	84
PID 1116 wrote to memory of 2312	1116	6037995835a785a752639476e649a992_JaffaCakes118.exe	84
PID 1116 wrote to memory of 1068	1116	6037995835a785a752639476e649a992_JaffaCakes118.exe	85
PID 1116 wrote to memory of 1068	1116	6037995835a785a752639476e649a992_JaffaCakes118.exe	85
PID 1116 wrote to memory of 1068	1116	6037995835a785a752639476e649a992_JaffaCakes118.exe	85
PID 1068 wrote to memory of 4540	1068	server.exe	89
PID 1068 wrote to memory of 4540	1068	server.exe	89
PID 1068 wrote to memory of 4540	1068	server.exe	89
PID 1068 wrote to memory of 4652	1068	server.exe	90
PID 1068 wrote to memory of 4652	1068	server.exe	90
PID 1068 wrote to memory of 4652	1068	server.exe	90
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 1068 wrote to memory of 4236	1068	server.exe	92
PID 4540 wrote to memory of 2160	4540	cmd.exe	94
PID 4540 wrote to memory of 2160	4540	cmd.exe	94
PID 4540 wrote to memory of 2160	4540	cmd.exe	94
PID 4652 wrote to memory of 4412	4652	cmd.exe	95
PID 4652 wrote to memory of 4412	4652	cmd.exe	95
PID 4652 wrote to memory of 4412	4652	cmd.exe	95

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2160	attrib.exe
4412	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6037995835a785a752639476e649a992_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6037995835a785a752639476e649a992_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\Software\PATCH.exe
  "C:\Users\Admin\AppData\Local\Temp\Software\PATCH.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\Software\server.exe
  "C:\Users\Admin\AppData\Local\Temp\Software\server.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Software\server.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\Software\server.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Software" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\Software" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4412
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:4236

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PATCH.exe

Path C:\Users\Admin\AppData\Local\Temp\Software\PATCH.exe
Size 660KB
SHA256 81420759e9c7e78cdfcd9f9762cddefb0a762b51ea16ca590dc32e586add555b
MD5 524bd1cd2232d5d3e66fed91a7fdeab6
SHA1 cda0e02beea1e719b17adc0caa52133033bd47cc
SHA512 281970960e0d0d3844629245428fe0c481d23c9ee66e4aaadeecb4ecee93abf9534ec5074b352986bd3defd3cd867258f1ee54bf2ad58091ed261e07ecd14998
SSDEEP 6144:1eyH3m0sER3m7DuDgJgyRW7tOYV7jkoy1wrQZaR+ls6Ziz8Im/e3hrje25DOhyXH:17m01mnQaRQ6Zirxrq2Eh8xwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\Software\server.exe
Size 252KB
SHA256 41441df8090040c6c1120a93dc1f5ff52f6ac775164671fd1f132b4447bca6cd
MD5 62d03f382181496a5da4d6ade3dde657
SHA1 4e1c6e0b12026f8c7df9f7074ec3035acb90aec8
SHA512 9cf07e5df28f6eead21a9ddb84b7838b946bd80a5c6383587b7dafca3d5fa0dc1761a5a810b8d7912bb40ce5b82d67b5352a5301674f33837ba5b722be1f4d6d
SSDEEP 6144:oD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ/:ol8E4w5huat7UovONzbXw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

bassmod.dll

Path C:\Users\Admin\AppData\Local\Temp\bassmod.dll
Size 9KB
SHA256 844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2
MD5 780d14604d49e3c634200c523def8351
SHA1 e208ef6f421d2260070a9222f1f918f1de0a8eeb
SHA512 a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b
SSDEEP 192:Yjtr1Et860Vu6tAo2j+feMnkqtDXuulsa7k0yRlm7/Pdl:AtU8Zu6K+feJCuwsL00la/Pd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-44-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-45-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-50-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-49-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-48-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-27-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-29-0x0000000002410000-0x0000000002411000-memory.dmp

Download

memory/1068-47-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-46-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-43-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-36-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-37-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-38-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-39-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-40-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-41-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1068-42-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1116-0-0x00007FF8383B5000-0x00007FF8383B6000-memory.dmp

Download

memory/1116-4-0x00007FF838100000-0x00007FF838AA1000-memory.dmp

Download

memory/1116-34-0x00007FF838100000-0x00007FF838AA1000-memory.dmp

Download

memory/1116-1-0x00007FF838100000-0x00007FF838AA1000-memory.dmp

Download

memory/1116-2-0x0000028F747D0000-0x0000028F747DA000-memory.dmp

Download

memory/1116-3-0x0000028F76A60000-0x0000028F76B06000-memory.dmp

Download

memory/2312-23-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/4236-35-0x0000000001110000-0x0000000001111000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads