darkcomet | 328ab38374c5c661a7dbb6b60b5aeb07f148c79d7e67c55c2d6270c7b67cfcf5

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe
Size 1.3MB
Sample240911-dnq2qszhrb
SHA256 328ab38374c5c661a7dbb6b60b5aeb07f148c79d7e67c55c2d6270c7b67cfcf5
MD5 d982c8902aa2ccae757bfe0288e8b47d
SHA1 f7eb4a0959f6ba16fad68d7078299ccbaee859f3
SHA512 78aee89cd724a7a45f4586dae88fdc7f6010f3fbb5115f8bdaa1f29b5a4eaaef2b17874b4333d5b2e94b241cf9ccf6bdef11bdd995b8d94e86ded0ac1451098e
SSDEEP 24576:qzWt0SOQDQZdxn2+EuRv13W+mipcphWztwxcxJbF9yabV7P:jt5weuXG+LpCWztwxcxJbF9yaZ7P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

slagathon.no-ip.biz:1604

Mutex

DC_MUTEX-YERQBB4

Attributes

gencode
FKYCjYkUY5HG
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4412	ƱƓӂƩƲ.exe
3272	smss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security Center Notify = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wscntfy.exe"	ƱƓӂƩƲ.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1040 set thread context of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ƱƓӂƩƲ.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3272	smss.exe
Token: SeSecurityPrivilege	3272	smss.exe
Token: SeTakeOwnershipPrivilege	3272	smss.exe
Token: SeLoadDriverPrivilege	3272	smss.exe
Token: SeSystemProfilePrivilege	3272	smss.exe
Token: SeSystemtimePrivilege	3272	smss.exe
Token: SeProfSingleProcessPrivilege	3272	smss.exe
Token: SeIncBasePriorityPrivilege	3272	smss.exe
Token: SeCreatePagefilePrivilege	3272	smss.exe
Token: SeBackupPrivilege	3272	smss.exe
Token: SeRestorePrivilege	3272	smss.exe
Token: SeShutdownPrivilege	3272	smss.exe
Token: SeDebugPrivilege	3272	smss.exe
Token: SeSystemEnvironmentPrivilege	3272	smss.exe
Token: SeChangeNotifyPrivilege	3272	smss.exe
Token: SeRemoteShutdownPrivilege	3272	smss.exe
Token: SeUndockPrivilege	3272	smss.exe
Token: SeManageVolumePrivilege	3272	smss.exe
Token: SeImpersonatePrivilege	3272	smss.exe
Token: SeCreateGlobalPrivilege	3272	smss.exe
Token: 33	3272	smss.exe
Token: 34	3272	smss.exe
Token: 35	3272	smss.exe
Token: 36	3272	smss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	smss.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1692	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	85
PID 1040 wrote to memory of 1692	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	85
PID 1040 wrote to memory of 1692	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	85
PID 1692 wrote to memory of 2224	1692	csc.exe	88
PID 1692 wrote to memory of 2224	1692	csc.exe	88
PID 1692 wrote to memory of 2224	1692	csc.exe	88
PID 1040 wrote to memory of 4412	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	89
PID 1040 wrote to memory of 4412	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	89
PID 1040 wrote to memory of 4412	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	89
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90
PID 1040 wrote to memory of 3272	1040	d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d982c8902aa2ccae757bfe0288e8b47d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\trkoel91.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES980B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC980A.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2224
- C:\Users\Admin\AppData\Local\Temp\ƱƓӂƩƲ.exe
  "C:\Users\Admin\AppData\Local\Temp\ƱƓӂƩƲ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\smss.exe
  C:\Users\Admin\AppData\Local\Temp\smss.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES980B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES980B.tmp
Size 1KB
SHA256 500757e73352f645a5552bb5a01a05cc65040b70ae4554084ff571963f1b1709
MD5 be7cd6643bf8ce250086072bdea9d1df
SHA1 3af90efef64d0d93487347b680936562034ac071
SHA512 c5014a246e8551c330618e4cf77567129dfdf1d50eead7759175397e87d14c3279ffdcef2fb77ebfa87a0ed9e2e010ff16def7131cf4d4c144848e7851239298
MD5 SHA1 SHA512

Submit Download

smss.exe

Path C:\Users\Admin\AppData\Local\Temp\smss.exe
Size 34KB
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
SSDEEP 768:Paq4bp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdn5y85p3:ud4+KTMVJHmMsEBKdn5vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ƱƓӂƩƲ.exe

Path C:\Users\Admin\AppData\Local\Temp\ƱƓӂƩƲ.exe
Size 4KB
SHA256 40b27ddf46ca43524fc1c6684995723c0eccfed0363e1424fad263171b017128
MD5 d392939c82abf3fd0a5d158a0f994215
SHA1 f6bc380c69cef29c9c3b4814ef168a3822b5ace9
SHA512 f65883a00669bc0e5c216137822e1178f3abc17802b844d7aad3498a4b41daeecf24707dfc1a1d761090e274c62a802084213dbe2af10438338d959868c34770
MD5 SHA1 SHA512

Submit Download

CSC980A.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC980A.tmp
Size 636B
SHA256 c8d6b2ec4071bb263e23ff98257568991b34850da5a7e1dba7272a6d6716779d
MD5 7fcfcddd6145a3b7804bdb4b1e442e79
SHA1 2720409b79c65e0a7e43e8484cae5b85688f4dde
SHA512 f57ef9ee1ffc442fc44697261039e9ee0a6d055a4d6b08d42c9f93e7fc97406420748b4e13525eae2102c7c12585c1f11f88787b54684ba088e6eba880652640
MD5 SHA1 SHA512

Submit Download

trkoel91.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\trkoel91.0.cs
Size 1KB
SHA256 6c48331742cf229c39b63c066683ff93cdf061070623364e205a6e17d93c471d
MD5 b2896eb49f4093d53af863e4fa31d370
SHA1 eed258ccf5ff39368e4f6c23725e85b224123c06
SHA512 9b0bd95f55c080aab31da37ac58c4795934d795ca3da6079c2252090f8cba6ce43717ee77439558f85da690e0fac332e1ebb1987e56af2fc68a81cef8b56cb2d
MD5 SHA1 SHA512

Submit Download

trkoel91.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\trkoel91.cmdline
Size 263B
SHA256 b20cef53c38ae311a183cf320fdea60d139775d64ac13728765b9c85202dce34
MD5 73d67326f7d6462cff576e236e40aa17
SHA1 e3d21acbd8e2a3daf09870709571b1c20e8038ab
SHA512 945a73a6a871ddbad9422d3a133a6802d0db61151b10b3e23a3af79c9c7574125e7c73c553b2c0c9f24b776adf9db66aae0337f55e8880bdfdfa6906ec223f80
MD5 SHA1 SHA512

Submit Download

memory/1040-1-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/1040-2-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/1040-0-0x0000000075262000-0x0000000075263000-memory.dmp

Download

memory/1040-30-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/1692-10-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/1692-15-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/3272-33-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-44-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-31-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-51-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-28-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-32-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-50-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-23-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-49-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-37-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-38-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-39-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-40-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-41-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-42-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-43-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-26-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-45-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-46-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-47-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3272-48-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/4412-36-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/4412-19-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/4412-20-0x0000000075260000-0x0000000075811000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads