darkcomet | 7381441c802c8fcfd6180757035c4a59587d32266f45d095c4b28d3825773623

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
Size

4.0MB
MD5

c2679c864a99ccc926d8d075e8d5cae6
SHA1

ac0bd541cc5c0e44b0b01b683dc70bfba04bfae4
SHA256

7381441c802c8fcfd6180757035c4a59587d32266f45d095c4b28d3825773623
SHA512

a8d222fb1b59c9993fc90cd8a89964df1b085363d72a2c470b0811818c1491b0a84dd9f84595364b09b8f6ec0a2a97a13fb08c08caa494b7ce72ca8a8b5f6680
SSDEEP

12288:tG9QQjb8Cw/xVJkw7bWk2UqbRA+dFiADbIO4CbySB/cZ6NJY8pqQUdqV/362MFsG:EE4au0ldX

Score

10^/10

darkcomet discovery persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3768	%tmp%.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000233fb-13.dat	upx
behavioral2/memory/3768-18-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/1240-21-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/1240-24-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/1240-22-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/1240-23-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/3768-27-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/1240-28-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/1240-29-0x0000000000400000-0x00000000004C4000-memory.dmp	upx
behavioral2/memory/1240-30-0x0000000000400000-0x00000000004C4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32 .exe"	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3768 set thread context of 1240	3768	%tmp%.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	%tmp%.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	%tmp%.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	%tmp%.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3768	%tmp%.exe
Token: SeSecurityPrivilege	3768	%tmp%.exe
Token: SeTakeOwnershipPrivilege	3768	%tmp%.exe
Token: SeLoadDriverPrivilege	3768	%tmp%.exe
Token: SeSystemProfilePrivilege	3768	%tmp%.exe
Token: SeSystemtimePrivilege	3768	%tmp%.exe
Token: SeProfSingleProcessPrivilege	3768	%tmp%.exe
Token: SeIncBasePriorityPrivilege	3768	%tmp%.exe
Token: SeCreatePagefilePrivilege	3768	%tmp%.exe
Token: SeBackupPrivilege	3768	%tmp%.exe
Token: SeRestorePrivilege	3768	%tmp%.exe
Token: SeShutdownPrivilege	3768	%tmp%.exe
Token: SeDebugPrivilege	3768	%tmp%.exe
Token: SeSystemEnvironmentPrivilege	3768	%tmp%.exe
Token: SeChangeNotifyPrivilege	3768	%tmp%.exe
Token: SeRemoteShutdownPrivilege	3768	%tmp%.exe
Token: SeUndockPrivilege	3768	%tmp%.exe
Token: SeManageVolumePrivilege	3768	%tmp%.exe
Token: SeImpersonatePrivilege	3768	%tmp%.exe
Token: SeCreateGlobalPrivilege	3768	%tmp%.exe
Token: 33	3768	%tmp%.exe
Token: 34	3768	%tmp%.exe
Token: 35	3768	%tmp%.exe
Token: 36	3768	%tmp%.exe
Token: SeIncreaseQuotaPrivilege	1240	explorer.exe
Token: SeSecurityPrivilege	1240	explorer.exe
Token: SeTakeOwnershipPrivilege	1240	explorer.exe
Token: SeLoadDriverPrivilege	1240	explorer.exe
Token: SeSystemProfilePrivilege	1240	explorer.exe
Token: SeSystemtimePrivilege	1240	explorer.exe
Token: SeProfSingleProcessPrivilege	1240	explorer.exe
Token: SeIncBasePriorityPrivilege	1240	explorer.exe
Token: SeCreatePagefilePrivilege	1240	explorer.exe
Token: SeBackupPrivilege	1240	explorer.exe
Token: SeRestorePrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeDebugPrivilege	1240	explorer.exe
Token: SeSystemEnvironmentPrivilege	1240	explorer.exe
Token: SeChangeNotifyPrivilege	1240	explorer.exe
Token: SeRemoteShutdownPrivilege	1240	explorer.exe
Token: SeUndockPrivilege	1240	explorer.exe
Token: SeManageVolumePrivilege	1240	explorer.exe
Token: SeImpersonatePrivilege	1240	explorer.exe
Token: SeCreateGlobalPrivilege	1240	explorer.exe
Token: 33	1240	explorer.exe
Token: 34	1240	explorer.exe
Token: 35	1240	explorer.exe
Token: 36	1240	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3768	2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe	92
PID 2816 wrote to memory of 3768	2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe	92
PID 2816 wrote to memory of 3768	2816	c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe	92
PID 3768 wrote to memory of 1240	3768	%tmp%.exe	93
PID 3768 wrote to memory of 1240	3768	%tmp%.exe	93
PID 3768 wrote to memory of 1240	3768	%tmp%.exe	93
PID 3768 wrote to memory of 1240	3768	%tmp%.exe	93
PID 3768 wrote to memory of 1240	3768	%tmp%.exe	93

C:\Users\Admin\AppData\Local\Temp\c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c2679c864a99ccc926d8d075e8d5cae6_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
  "C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

Filesize
264KB

MD5
e6a6c21dd164926685c9755e01a1fef3

SHA1
351b9b0e2553dac0d54657cdc5de36ad15a4a8e4

SHA256
dd26f4e052a6b438b4bfa36eff7110f39a873d61006e7de6b9f4826fb19f3585

SHA512
687b32c3835a8464374e7bb9c103be851a12a6e5bc4f6557642488861bb4295cd460e81bb128155d8c10c02b15538be45197de318d20e262e3bfdd23df7c8274

Download Submit
memory/1240-30-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1240-28-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1240-21-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1240-24-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1240-22-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1240-23-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1240-25-0x0000000000530000-0x0000000000963000-memory.dmp

Filesize
4.2MB

Download
memory/1240-29-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2816-2-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/2816-1-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/2816-0-0x0000000074AC2000-0x0000000074AC3000-memory.dmp

Filesize
4KB

Download
memory/2816-19-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/3768-18-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/3768-27-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/3768-20-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download