darkcomet | f7474ff3bed232bfa8756ac5daff50ec36c992e62c1e89944308721a6b78f634

General

Target

3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe
Size

1.6MB
MD5

3c44c0eea3ad1902735eeb10f8088a17
SHA1

179cd5f9ed8c97ac55f16f39a3d247b42f6d79b6
SHA256

f7474ff3bed232bfa8756ac5daff50ec36c992e62c1e89944308721a6b78f634
SHA512

c417dcdb8a2958cad119804e24d46f88eedf77fc822b04741eda4096e2ada567e27803a33f3eacb757c59c371960a576c97907a9cd6176e21e27ac27bf80af9a
SSDEEP

24576:7O+Qshyhqj80MVBXnNBSUKBlVB5wAusKMduaOYNt0WPnF9i0tFUDwcgl3g16AO09:amCq4Njd/KVBXuyHqwjJ0tT

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

pid	Process
2932	Processname.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup Name = "C:\\Users\\Admin\\AppData\\Roaming\\Amandaknis.exe"	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3252 set thread context of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Processname.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2932	Processname.exe
Token: SeSecurityPrivilege	2932	Processname.exe
Token: SeTakeOwnershipPrivilege	2932	Processname.exe
Token: SeLoadDriverPrivilege	2932	Processname.exe
Token: SeSystemProfilePrivilege	2932	Processname.exe
Token: SeSystemtimePrivilege	2932	Processname.exe
Token: SeProfSingleProcessPrivilege	2932	Processname.exe
Token: SeIncBasePriorityPrivilege	2932	Processname.exe
Token: SeCreatePagefilePrivilege	2932	Processname.exe
Token: SeBackupPrivilege	2932	Processname.exe
Token: SeRestorePrivilege	2932	Processname.exe
Token: SeShutdownPrivilege	2932	Processname.exe
Token: SeDebugPrivilege	2932	Processname.exe
Token: SeSystemEnvironmentPrivilege	2932	Processname.exe
Token: SeChangeNotifyPrivilege	2932	Processname.exe
Token: SeRemoteShutdownPrivilege	2932	Processname.exe
Token: SeUndockPrivilege	2932	Processname.exe
Token: SeManageVolumePrivilege	2932	Processname.exe
Token: SeImpersonatePrivilege	2932	Processname.exe
Token: SeCreateGlobalPrivilege	2932	Processname.exe
Token: 33	2932	Processname.exe
Token: 34	2932	Processname.exe
Token: 35	2932	Processname.exe
Token: 36	2932	Processname.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2932	3252	3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c44c0eea3ad1902735eeb10f8088a17_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Roaming\Processname.exe
  C:\Users\Admin\AppData\Roaming\Processname.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Processname.exe

Filesize
1KB

MD5
a24f8ab59aaf98257dbaea9c3acfc56f

SHA1
e6c8248f02d1af385e269363e9b7663a8ce2b31a

SHA256
d0955230488592f2cb6b776c26456477da537cfd0a2352dd1314d0786c5f5803

SHA512
8e3765901f5ae33c3d05878c8e8e88112c52eed5b6b8bc49d40a5b62635b7dd5b101f5c1b659b4a1dfb9c72a776a6ccd3ce141887e8301ad10f49406b9117570

Download Submit
memory/2932-25-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-16-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2932-31-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-11-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-13-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-29-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-15-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-19-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-20-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2932-18-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-28-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-17-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-7-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-21-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-22-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-23-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-24-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-27-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2932-26-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/3252-0-0x0000000074C92000-0x0000000074C93000-memory.dmp

Filesize
4KB

Download
memory/3252-2-0x0000000074C90000-0x0000000075241000-memory.dmp

Filesize
5.7MB

Download
memory/3252-12-0x0000000074C90000-0x0000000075241000-memory.dmp

Filesize
5.7MB

Download
memory/3252-1-0x0000000074C90000-0x0000000075241000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads