darkcomet | 8b9dda116a71368a9de721e5cd6c6de05c9f9deb692d7e7f623e60d9a9972b5c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Size 916KB
Sample240723-mlsl8a1ele
SHA256 8b9dda116a71368a9de721e5cd6c6de05c9f9deb692d7e7f623e60d9a9972b5c
MD5 6738a68d6ca982d3eb8bb18261ade528
SHA1 b28b8bdb0527c9befad62bd93f937f1597a13815
SHA512 4d962c2cda9071fe67bca99db4e70fb7a2906447a85c0516f7793421d9ce4d01c14f573e29fafe0c6fac9d4e77ee3a508aeced37aeffaf63267ae8b8f975c340
SSDEEP 12288:Pw5wNzoYqZtfEJRplx8Y1tcDiYifuMPcWTb0vLwySQ5xH:PBGYkfGzVcDiYimM0DLwySQf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
Nl2fmspeVP53
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeSecurityPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeSystemtimePrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeBackupPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeRestorePrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeShutdownPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeDebugPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeUndockPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeManageVolumePrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeImpersonatePrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: 33	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: 34	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: 35	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
Token: 36	5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5012	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87
PID 1404 wrote to memory of 5012	1404	6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\6738a68d6ca982d3eb8bb18261ade528_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-11-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/5012-4-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-8-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-12-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-6-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-14-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-10-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5012-15-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/5012-16-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads