darkcomet | 8215ca9e02357b4a0019f8813a658a26adbbce59ae3bafb963bfbe0cec81db57

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe
Size 1.2MB
Sample240724-lwpgwasgmc
SHA256 8215ca9e02357b4a0019f8813a658a26adbbce59ae3bafb963bfbe0cec81db57
MD5 6b26b953fc279e0883d5ee11354b8661
SHA1 04bc5e768bf5ccfd82fa9f833b167d4a45ce7420
SHA512 7e76dce8705d2efd2d263938c955c612e865479e876c0406542cd2bfe73096a1dcecac0d740522abd0fb605a3299157a4959ce8425e93734f9dc4dd3bec61d03
SSDEEP 24576:LsUgX+vFcZsyFmHraK8HXhSQcQzH4cGFq0mp7EAOit5OQmF5Rgcj7TK:opgc2yYHW73c+4cGQ0mzZy5fT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet latentbot youtube discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

YOUTUBE

superduperfly75.zapto.org:1604

Mutex

DCMIN_MUTEX-N89DPZW

Attributes

gencode
pMfPxC3iW6vG
install
false
offline_keylogger
true
persistence
false

Extracted

Family

latentbot

superduperfly75.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	Utube.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Utube.exe	824898.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Utube.exe	824898.exe

Executes dropped EXE 4 IoCs

pid	Process
4768	Utube.exe
1260	RES.exe
1908	824898.exe
4848	REFRAC~4.EXE

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	Utube.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Utube.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 1260	4768	Utube.exe	88

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	Utube.exe
File created	C:\Windows\assembly\Desktop.ini	Utube.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Utube.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RES.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	824898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REFRAC~4.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Utube.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1260	RES.exe
Token: SeSecurityPrivilege	1260	RES.exe
Token: SeTakeOwnershipPrivilege	1260	RES.exe
Token: SeLoadDriverPrivilege	1260	RES.exe
Token: SeSystemProfilePrivilege	1260	RES.exe
Token: SeSystemtimePrivilege	1260	RES.exe
Token: SeProfSingleProcessPrivilege	1260	RES.exe
Token: SeIncBasePriorityPrivilege	1260	RES.exe
Token: SeCreatePagefilePrivilege	1260	RES.exe
Token: SeBackupPrivilege	1260	RES.exe
Token: SeRestorePrivilege	1260	RES.exe
Token: SeShutdownPrivilege	1260	RES.exe
Token: SeDebugPrivilege	1260	RES.exe
Token: SeSystemEnvironmentPrivilege	1260	RES.exe
Token: SeChangeNotifyPrivilege	1260	RES.exe
Token: SeRemoteShutdownPrivilege	1260	RES.exe
Token: SeUndockPrivilege	1260	RES.exe
Token: SeManageVolumePrivilege	1260	RES.exe
Token: SeImpersonatePrivilege	1260	RES.exe
Token: SeCreateGlobalPrivilege	1260	RES.exe
Token: 33	1260	RES.exe
Token: 34	1260	RES.exe
Token: 35	1260	RES.exe
Token: 36	1260	RES.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1260	RES.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4768	3528	6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe	84
PID 3528 wrote to memory of 4768	3528	6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe	84
PID 3528 wrote to memory of 4768	3528	6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe	84
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 1260	4768	Utube.exe	88
PID 4768 wrote to memory of 4012	4768	Utube.exe	89
PID 4768 wrote to memory of 4012	4768	Utube.exe	89
PID 4768 wrote to memory of 4012	4768	Utube.exe	89
PID 4012 wrote to memory of 2016	4012	vbc.exe	91
PID 4012 wrote to memory of 2016	4012	vbc.exe	91
PID 4012 wrote to memory of 2016	4012	vbc.exe	91
PID 4768 wrote to memory of 1908	4768	Utube.exe	96
PID 4768 wrote to memory of 1908	4768	Utube.exe	96
PID 4768 wrote to memory of 1908	4768	Utube.exe	96
PID 3528 wrote to memory of 4848	3528	6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe	97
PID 3528 wrote to memory of 4848	3528	6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe	97
PID 3528 wrote to memory of 4848	3528	6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6b26b953fc279e0883d5ee11354b8661_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Utube.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Utube.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Roaming\RES.exe
    C:\Users\Admin\AppData\Roaming\RES.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1260
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gawq5rty.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9441.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcACE96C2A9E974A0D9BE24630962F12B4.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2016
- - C:\Users\Admin\AppData\Roaming\824898.exe
    "C:\Users\Admin\AppData\Roaming\824898.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1908
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REFRAC~4.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REFRAC~4.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

REFRAC~4.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REFRAC~4.EXE
Size 38KB
SHA256 f44542297b74f9ff431da92f3757b86fe272ed88d70df4946f78cf4a062c95dd
MD5 1ee0feeaa8b4ec6d979089e77df7969f
SHA1 eb6d30151989b14b9072b9013cbb1f87561f85b5
SHA512 412f337e3fe16cfba7cb281c45b730c31a6749bcefeade449c780ca7971b8a9676636864e11723ef849c56802127380d85a84e69a4b0253c7860be786f96401f
SSDEEP 768:N/O93bDV1AFjLUdyPzaEhuWLK77MUF42XPYS9Mn3N6y7D++A:NWl6F3UUTKMp2ffum
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utube.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Utube.exe
Size 1.5MB
SHA256 d8ae8f0ca1db9160b3880adeaaae7dcfe532048d00286da703bb300ca9bd7c0c
MD5 ed46d29f422bd2fd6fac4ed2c51d8eaf
SHA1 655a109f5094adc7b4bde01cf28d204b42de7578
SHA512 ac9e165b20030374d73b3a2a627ea4e8135e6da88d6fc080f4433d1e8fedafa0bcb30321b00b768d215e9771e3e984321fc862a3d11c0a7582528691ed845449
SSDEEP 24576:4BkgtbIvi+oHenpVeSrvb7J+u0kdV17eW/GosP9h4/EKM5pf32JuBw47TYO7:WhZI6+o+fx5+u0i7e8sPeEKMnPCwTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES9441.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9441.tmp
Size 1KB
SHA256 b5b5d7f45afaae35410dea0f51546c2bbce1f58f688981e9b60509bec1663184
MD5 560cdc24b2188f2d805c4d0b656eb026
SHA1 ceacb9a0ac7b7c669202dd19576913af7bdda369
SHA512 b64ac19e843462ecfc9a193b361215bd5f3ada5407f2b3bd3a0ff951e34c93d3aa0e8f52415edc4f138813fd64aafa31c3cd511c9b055e7f33b20fa7fefa7c0d
MD5 SHA1 SHA512

Submit Download

gawq5rty.0.vb

Path C:\Users\Admin\AppData\Local\Temp\gawq5rty.0.vb
Size 1KB
SHA256 e57e06e9861b73edfdbd3e78f28ee05716b2fd4361ad3085eba86ba9705227ab
MD5 14a42f558f43589730af980523639c8d
SHA1 0cfdbaf72b2f28f1eea23b9a49649b0520e91756
SHA512 41b8fa42b4fddd2f3df640a4f6b2966ead14df737b8201f3212b015464928746372448217b8e059ea8bc46acd630f449f30c2bc3e88b8b3d819c7c88601a14fe
MD5 SHA1 SHA512

Submit Download

gawq5rty.cmdline

Path C:\Users\Admin\AppData\Local\Temp\gawq5rty.cmdline
Size 234B
SHA256 670aede8136616628437d7202486aea2ffaf2a73e4fbc95c297bd49b0b633ffd
MD5 cd1a18f9d0ee160baa3f67518efe9851
SHA1 04b6a3388c339cddd4c697ac13ec275e739b2ece
SHA512 df49148de7225f3a43fc39f8ab42d824cf1c2bfe492afc6b904a0667cd9be25c064a8f02905f9911328638227ebc664f00e599c08bd88f34e1691090e43612dc
MD5 SHA1 SHA512

Submit Download

vbcACE96C2A9E974A0D9BE24630962F12B4.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcACE96C2A9E974A0D9BE24630962F12B4.TMP
Size 880B
SHA256 e29c3ef5adc6818c4090b4312e363eb32f96387d2f0b196045d9bc8f74255ba0
MD5 bd963f624f1dbee550dd48f72c97ad76
SHA1 4cc2cf901f372266acb45933c18d0637c6dc5ee1
SHA512 97ebc5e940bfe6e49232e9bd7d819dc8775d1be622bf0f4961b3641baa110ad1167eb5facc96e3da84a08e9a5b223fb0c690e366c6cb8bb1104726e838205648
MD5 SHA1 SHA512

Submit Download

824898.exe

Path C:\Users\Admin\AppData\Roaming\824898.exe
Size 7KB
SHA256 5b2c23eb3a67b0a5a8e0bf446ef1c0bc3052fdffe679fdd75e032434c839a972
MD5 80453b5eec319c12d32a4b9f076d8917
SHA1 e6a532e88af24eeb2cbf5e5d554bfde3ac946270
SHA512 d3188e2cdde56600d0333eb98498665e9bb279081457c7561d7d7b892f3810baa49ded978a2eab2849ef78cf4d220fe3787db0e6ef10f6c5515dddd58f706276
SSDEEP 192:yLTY2IUSZxcWVdAWnlYJLCLTsUXuWsP8:yLTIPUWTCmLTT+WsP8
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES.exe

Path C:\Users\Admin\AppData\Roaming\RES.exe
Size 1KB
SHA256 62bf121e7c7d3a221718d90de673ab23b9759765bb4aaed747883c7c7d08c2c5
MD5 f54b30f21b7b118bfeda2b1ed3482f84
SHA1 bde084ea60646dadabfed4eafe5bafceb4c11b99
SHA512 8431f8c37b0fbc1077eb0aef78ad2e10c11bb10e16ddbde833f568cbd69551e23c85aadcce4ddc71994a9fede59eca52bc99d595131c2264e4e9917abe87e44d
MD5 SHA1 SHA512

Submit Download

memory/1260-54-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-25-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-24-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/1260-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-53-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1260-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4012-29-0x0000000002370000-0x0000000002380000-memory.dmp

Download

memory/4768-7-0x00000000747E2000-0x00000000747E3000-memory.dmp

Download

memory/4768-8-0x00000000747E0000-0x0000000074D91000-memory.dmp

Download

memory/4768-41-0x00000000747E0000-0x0000000074D91000-memory.dmp

Download

memory/4768-9-0x00000000747E0000-0x0000000074D91000-memory.dmp

Download

memory/4848-52-0x0000000005310000-0x0000000005366000-memory.dmp

Download

memory/4848-51-0x0000000005170000-0x000000000517A000-memory.dmp

Download

memory/4848-50-0x0000000005270000-0x0000000005302000-memory.dmp

Download

memory/4848-49-0x0000000005780000-0x0000000005D24000-memory.dmp

Download

memory/4848-48-0x00000000050A0000-0x000000000513C000-memory.dmp

Download

memory/4848-47-0x00000000006D0000-0x00000000006E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads