darkcomet | 2d819586555e77de60cd2fff7069c1d676e81a74b309447bc9d3aed826576199

General

Target

26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Size

232KB
MD5

26ba4a0f4141220f722024969faf3c62
SHA1

92ff119655b5aeddbfa7fee79196aba3799eb5b3
SHA256

2d819586555e77de60cd2fff7069c1d676e81a74b309447bc9d3aed826576199
SHA512

97873357825652ab3eab9ef031d229601ce84d68f2d3e0de675299f82c1e5aa0ee33ee8eeb5b6f2821b4cf352f94f6d0f8015d8da7324dd22824adcc5945dfea
SSDEEP

6144:tyspTumMBqxIUyDE0jNPm1TN2VRHrfxWoyO:Q+upOIfJmf2fgoD

Score

10^/10

darkcomet discovery rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeSecurityPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeBackupPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeRestorePrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeShutdownPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeDebugPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeUndockPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: 33	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: 34	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
Token: 35	2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2660	26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
2704	DllHost.exe
2704	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26ba4a0f4141220f722024969faf3c62_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IMAGES.JPG

Filesize
3KB

MD5
7674c578ff9c48371303c1956e360f43

SHA1
de32b97913055e7a269d7da788e22ca88faa08c7

SHA256
ab2bef2cb70970ba9a1a5b520447920b6900b246c5d7ba62c93c27b3f51a37e8

SHA512
f257826857a40be2c126e69317186900f8884ac0db99a0ac1e1ee5c5a646607c4349e1ed546fc3e256eda5646acabd4079213fda06b8b695199e14331d56a43e

Download Submit
memory/2660-0-0x0000000013140000-0x00000000131F9000-memory.dmp

Filesize
740KB

Download
memory/2660-1-0x0000000000250000-0x0000000000253000-memory.dmp

Filesize
12KB

Download
memory/2660-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2660-4-0x00000000039E0000-0x00000000039E2000-memory.dmp

Filesize
8KB

Download
memory/2660-8-0x0000000013140000-0x00000000131F9000-memory.dmp

Filesize
740KB

Download
memory/2660-11-0x0000000013140000-0x00000000131F9000-memory.dmp

Filesize
740KB

Download
memory/2704-5-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download
memory/2704-6-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2704-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing