darkcomet | ead0fc8e813f6db3cf84cee547be2f6f1c9f03b606421c736f11c062937c3dc9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe
Size 704KB
Sample240722-arg2fsvdrn
SHA256 ead0fc8e813f6db3cf84cee547be2f6f1c9f03b606421c736f11c062937c3dc9
MD5 620af7b60cd12d45630c8d254c158139
SHA1 e8376adb5c5824c48cb73a0205ff567232e813eb
SHA512 9d5d7e44a4066dec8b0795310720a5da432e1b8582eb9a9e79a60889540effd4cff3a4d2781237aee71515b580b86f163de51960f49b78c3e5f8867c4728800b
SSDEEP 12288:M7pgQNvpFBNpQQqiR7RD3rvPFz/drQtQl2G+ot9PlHY6hRxuU00:M3NvVNqXiRRrHrB2GLl1M3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet avec_dns evasion rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

avec_dns

dark-sam.no-ip.org:1604

Mutex

DC_MUTEX-E99E03J

Attributes

gencode
q4T9jpjHRf00
install
false
offline_keylogger
true
password
180818sa
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3252	attrib.exe
60	attrib.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3648 set thread context of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727	attrib.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4808	vbc.exe
Token: SeSecurityPrivilege	4808	vbc.exe
Token: SeTakeOwnershipPrivilege	4808	vbc.exe
Token: SeLoadDriverPrivilege	4808	vbc.exe
Token: SeSystemProfilePrivilege	4808	vbc.exe
Token: SeSystemtimePrivilege	4808	vbc.exe
Token: SeProfSingleProcessPrivilege	4808	vbc.exe
Token: SeIncBasePriorityPrivilege	4808	vbc.exe
Token: SeCreatePagefilePrivilege	4808	vbc.exe
Token: SeBackupPrivilege	4808	vbc.exe
Token: SeRestorePrivilege	4808	vbc.exe
Token: SeShutdownPrivilege	4808	vbc.exe
Token: SeDebugPrivilege	4808	vbc.exe
Token: SeSystemEnvironmentPrivilege	4808	vbc.exe
Token: SeChangeNotifyPrivilege	4808	vbc.exe
Token: SeRemoteShutdownPrivilege	4808	vbc.exe
Token: SeUndockPrivilege	4808	vbc.exe
Token: SeManageVolumePrivilege	4808	vbc.exe
Token: SeImpersonatePrivilege	4808	vbc.exe
Token: SeCreateGlobalPrivilege	4808	vbc.exe
Token: 33	4808	vbc.exe
Token: 34	4808	vbc.exe
Token: 35	4808	vbc.exe
Token: 36	4808	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	vbc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 3648 wrote to memory of 4808	3648	620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe	84
PID 4808 wrote to memory of 1508	4808	vbc.exe	93
PID 4808 wrote to memory of 1508	4808	vbc.exe	93
PID 4808 wrote to memory of 1508	4808	vbc.exe	93
PID 4808 wrote to memory of 2012	4808	vbc.exe	94
PID 4808 wrote to memory of 2012	4808	vbc.exe	94
PID 4808 wrote to memory of 2012	4808	vbc.exe	94
PID 2012 wrote to memory of 60	2012	cmd.exe	97
PID 2012 wrote to memory of 60	2012	cmd.exe	97
PID 2012 wrote to memory of 60	2012	cmd.exe	97
PID 1508 wrote to memory of 3252	1508	cmd.exe	98
PID 1508 wrote to memory of 3252	1508	cmd.exe	98
PID 1508 wrote to memory of 3252	1508	cmd.exe	98

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
60	attrib.exe
3252	attrib.exe

C:\Users\Admin\AppData\Local\Temp\620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\620af7b60cd12d45630c8d254c158139_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3648-8-0x0000000074940000-0x0000000074EF1000-memory.dmp

Download

memory/3648-1-0x0000000074940000-0x0000000074EF1000-memory.dmp

Download

memory/3648-2-0x0000000074940000-0x0000000074EF1000-memory.dmp

Download

memory/3648-0-0x0000000074942000-0x0000000074943000-memory.dmp

Download

memory/4808-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-14-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-5-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-10-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-11-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-12-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-6-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-15-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-16-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-17-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-18-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-19-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-20-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-21-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-22-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-23-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4808-24-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads