darkcomet | 00e4aecf66b5a0d78cbb847faa2a90c13de6766b210bacf0ab45b14527632956

General

Target

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Size

561KB
MD5

f7e46f94490dd52b83ed089ccdbe5357
SHA1

163ae8daa487c8c3bb144514d64f3971695bb2f6
SHA256

00e4aecf66b5a0d78cbb847faa2a90c13de6766b210bacf0ab45b14527632956
SHA512

840e30bb7bf7d2210b23efa4e8324f5dc35d73dabee0c7f961e1ee52557e0e2b8d784d6e98f818434124991371fdc0fd8ebfed3b0b70c6c914bdd7e019c4eeed
SSDEEP

12288:ZoS493ACIl7vI1kiqHNnyVek/a4AmHNX467pnIORK5GkR7lRPT5lLwEC8G:ZoIjIbgyLC4t5467uOk5GkFT5d6n

Score

10^/10

darkcomet guest16_min discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

192.168.1.104:1604

Mutex

DCMIN_MUTEX-WAM0AFU

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
NUrjBWf75vjx
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

IMDCSC.exeIMDCSC.exe

pid process

2684 IMDCSC.exe
2844 IMDCSC.exe
Loads dropped DLL 3 IoCs

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exeIMDCSC.exe

pid process

2328 f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
2328 f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
2684 IMDCSC.exe

pid	process
2684	IMDCSC.exe
2844	IMDCSC.exe

pid	process
2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
2684	IMDCSC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exeIMDCSC.exe

description	pid	process	target process
PID 2972 set thread context of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2684 set thread context of 2844	2684	IMDCSC.exe	IMDCSC.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2328-16-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-14-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-12-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-9-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-6-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-17-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-18-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-20-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-19-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-21-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2328-31-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-53-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-56-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-55-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-54-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-58-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-57-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-59-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/2844-62-0x0000000000400000-0x00000000004B6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exef7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exeIMDCSC.exeIMDCSC.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exeIMDCSC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeSecurityPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeBackupPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeRestorePrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeShutdownPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeDebugPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeUndockPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: 33	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: 34	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: 35	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2844	IMDCSC.exe
Token: SeSecurityPrivilege	2844	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	2844	IMDCSC.exe
Token: SeLoadDriverPrivilege	2844	IMDCSC.exe
Token: SeSystemProfilePrivilege	2844	IMDCSC.exe
Token: SeSystemtimePrivilege	2844	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	2844	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	2844	IMDCSC.exe
Token: SeCreatePagefilePrivilege	2844	IMDCSC.exe
Token: SeBackupPrivilege	2844	IMDCSC.exe
Token: SeRestorePrivilege	2844	IMDCSC.exe
Token: SeShutdownPrivilege	2844	IMDCSC.exe
Token: SeDebugPrivilege	2844	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	2844	IMDCSC.exe
Token: SeChangeNotifyPrivilege	2844	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	2844	IMDCSC.exe
Token: SeUndockPrivilege	2844	IMDCSC.exe
Token: SeManageVolumePrivilege	2844	IMDCSC.exe
Token: SeImpersonatePrivilege	2844	IMDCSC.exe
Token: SeCreateGlobalPrivilege	2844	IMDCSC.exe
Token: 33	2844	IMDCSC.exe
Token: 34	2844	IMDCSC.exe
Token: 35	2844	IMDCSC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exeIMDCSC.exeIMDCSC.exe

pid process

2972 f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
2684 IMDCSC.exe
2844 IMDCSC.exe

pid	process
2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
2684	IMDCSC.exe
2844	IMDCSC.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exef7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exeIMDCSC.exe

description	pid	process	target process
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2972 wrote to memory of 2328	2972	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
PID 2328 wrote to memory of 2684	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	IMDCSC.exe
PID 2328 wrote to memory of 2684	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	IMDCSC.exe
PID 2328 wrote to memory of 2684	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	IMDCSC.exe
PID 2328 wrote to memory of 2684	2328	f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe
PID 2684 wrote to memory of 2844	2684	IMDCSC.exe	IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
    "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

Filesize
561KB

MD5
f7e46f94490dd52b83ed089ccdbe5357

SHA1
163ae8daa487c8c3bb144514d64f3971695bb2f6

SHA256
00e4aecf66b5a0d78cbb847faa2a90c13de6766b210bacf0ab45b14527632956

SHA512
840e30bb7bf7d2210b23efa4e8324f5dc35d73dabee0c7f961e1ee52557e0e2b8d784d6e98f818434124991371fdc0fd8ebfed3b0b70c6c914bdd7e019c4eeed

Download Submit
memory/2328-19-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-6-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-16-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-20-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-14-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-12-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-9-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-31-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-4-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2328-17-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-18-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2328-21-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2684-37-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2684-51-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2684-33-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2844-57-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2844-62-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2844-53-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2844-56-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2844-55-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2844-54-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2844-58-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2844-59-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2972-15-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2972-0-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2972-3-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2972-13-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads