darkcomet | 113ce9531b63f5632f6f71982235a8ef08ce9d9a39cfcfcf87eed4a999f187f5

General

Target

a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe
Size

1.3MB
MD5

a90a831be3b6242816714cafe59eda9a
SHA1

6dbb008fd637ae00e1d7b2390d99776fff13f800
SHA256

113ce9531b63f5632f6f71982235a8ef08ce9d9a39cfcfcf87eed4a999f187f5
SHA512

50ae58b387049b01f22634da56d9acff3d4e51e1387297cf730037446de1a903d877820aff7f600dfd7e3d6079b0fd00ac749a97320ea77fc217777cdec4338d
SSDEEP

24576:dIp0jwWZFybBDxIPlaQSbWaRDoZNKLqMKNrjFLTrTnEK5IsgssDssPsgWS6DZZ/:XwWZkBtelaQgRDoZomNXFLTXdo6DZ

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 2 IoCs

pid	Process
2572	ǭƜƐƉƏ.exe
2860	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe
2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe
2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MsMpEng.exe"	ǭƜƐƉƏ.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ǭƜƐƉƏ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2860	svchost.exe
Token: SeSecurityPrivilege	2860	svchost.exe
Token: SeTakeOwnershipPrivilege	2860	svchost.exe
Token: SeLoadDriverPrivilege	2860	svchost.exe
Token: SeSystemProfilePrivilege	2860	svchost.exe
Token: SeSystemtimePrivilege	2860	svchost.exe
Token: SeProfSingleProcessPrivilege	2860	svchost.exe
Token: SeIncBasePriorityPrivilege	2860	svchost.exe
Token: SeCreatePagefilePrivilege	2860	svchost.exe
Token: SeBackupPrivilege	2860	svchost.exe
Token: SeRestorePrivilege	2860	svchost.exe
Token: SeShutdownPrivilege	2860	svchost.exe
Token: SeDebugPrivilege	2860	svchost.exe
Token: SeSystemEnvironmentPrivilege	2860	svchost.exe
Token: SeChangeNotifyPrivilege	2860	svchost.exe
Token: SeRemoteShutdownPrivilege	2860	svchost.exe
Token: SeUndockPrivilege	2860	svchost.exe
Token: SeManageVolumePrivilege	2860	svchost.exe
Token: SeImpersonatePrivilege	2860	svchost.exe
Token: SeCreateGlobalPrivilege	2860	svchost.exe
Token: 33	2860	svchost.exe
Token: 34	2860	svchost.exe
Token: 35	2860	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2860	svchost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2812	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	30
PID 2136 wrote to memory of 2812	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	30
PID 2136 wrote to memory of 2812	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	30
PID 2136 wrote to memory of 2812	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	30
PID 2812 wrote to memory of 2388	2812	csc.exe	32
PID 2812 wrote to memory of 2388	2812	csc.exe	32
PID 2812 wrote to memory of 2388	2812	csc.exe	32
PID 2812 wrote to memory of 2388	2812	csc.exe	32
PID 2136 wrote to memory of 2572	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	33
PID 2136 wrote to memory of 2572	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	33
PID 2136 wrote to memory of 2572	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	33
PID 2136 wrote to memory of 2572	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	33
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34
PID 2136 wrote to memory of 2860	2136	a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a90a831be3b6242816714cafe59eda9a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mz9iyhtw.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31CB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC31CA.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388
- C:\Users\Admin\AppData\Local\Temp\ǭƜƐƉƏ.exe
  "C:\Users\Admin\AppData\Local\Temp\ǭƜƐƉƏ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES31CB.tmp

Filesize
1KB

MD5
fbc990ad3460a24428c205cdd1401077

SHA1
55e4e31e7f748fc736e602f8bc183c6dc9102227

SHA256
7cb5405d8d93cf32a7d64232a654f2d06263dfb552878f46ceae375d18a0f7ff

SHA512
83dd85ae2923aa51ca3903099fcb6d462c3edcaa120f0f08c8500ca39531807ba8ae2ce5ce399b95ade7af54e2eb456599f81037c3f470918900d153e0eb0287

Download Submit
C:\Users\Admin\AppData\Local\Temp\ǭƜƐƉƏ.exe

Filesize
4KB

MD5
683f2d379e435ea26bf264cdbe97f725

SHA1
48a3101ed3da3c85a42bfe3fcbe444b2d50ba9de

SHA256
f6d1315e1330e446055a891bcdece0d4659d855ba9fb2e046b6e212ffb70e92f

SHA512
f532c03b07087f6bfc21aaf57ceea39cae332ce65d1f4146c0cb1cc47a4d42d127945f5b8b43e1aee314329ae225b96dd7a0dcee3d507f62445fb1e50a901fdc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC31CA.tmp

Filesize
636B

MD5
aa55bfb476edff4caf06776dd476a7eb

SHA1
2a7a48f3a18ea75bd09fa1f00f09de6efae51da0

SHA256
45b60e742758075b2814da6fbe51e7e87730dde243ec6c19fced91f2e0fb30ad

SHA512
f46f71ea00a2f5c494ce4ed9df08445b2e0ab55676eefac54846fdaca62b0cdbae122957f659cc365d10c8ebf5b79b19915e9f6fa256b57cfe33d6e219df68df

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mz9iyhtw.0.cs

Filesize
1KB

MD5
c444b297bee6496d6ec55c6d8403cf10

SHA1
98dd2bb27e9b12196a9904ac9837da8dae7f2604

SHA256
c1c146f485e88b1334eb91ebd9a0178e6afe13864bd54d9cf30786cf78628f9e

SHA512
63de86de5d336686cde5c28adc42b256511c21512ee7e444051909690266f71835f176318c57c2a681527e1496954eac2c0acfe66ba44a5a253be51d3fad8e7d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mz9iyhtw.cmdline

Filesize
263B

MD5
3b7e0f785fd5d15731b4faa0156a753b

SHA1
6310ef85f9556827950916c8544168569a40281e

SHA256
547e884bcf66eff9b101c3bed5ffaf1783f186c30b7a119a67c2e3feb0adac69

SHA512
61096b550c50682f430cc4a215fd76b6796bca7b2007d8c21288e5b1229f8ec728a434369d4f8026852f8ed39257cbde051e1856e959cc8f1660de76739a9a8b

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/2136-45-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/2136-1-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/2136-2-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/2136-0-0x00000000749D1000-0x00000000749D2000-memory.dmp

Filesize
4KB

Download
memory/2812-8-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/2812-15-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-31-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-47-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-42-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2860-39-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-37-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-35-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-33-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-25-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-29-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-46-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-49-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-48-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-27-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-51-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-52-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-53-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-54-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-55-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-56-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-57-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-58-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-59-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-60-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-61-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-62-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-63-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2860-64-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads