darkcomet | 3e6b574ae73a735fde06db712e8c7f2d767e14acba572942ff4b9a2553c557b2

General

Target

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
Size

1.0MB
MD5

496b3e5f673f5407ea4a55c1d17736a5
SHA1

be6b5eae60384d6c99011f003a277c0c3031bc80
SHA256

3e6b574ae73a735fde06db712e8c7f2d767e14acba572942ff4b9a2553c557b2
SHA512

2531dc8457f9001a73b451a9fd3a0f93e56fcc77114f14a13c7ddfcb70fdab3b95c50cdeb1c8dd0fc2b8889347d022e4abd13512b077f5daae12449b0ea487d1
SSDEEP

12288:K9DlmwWmfA71dcgvP7OimiRTH54nqosMbkf8Jyiebft56QcC4Ty089SI3l87d4pZ:0NA1xFRNJo7PU5IPalY7TB4EMj8B

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

jesusmanwoohoo.no-ip.org:1604

Mutex

DC_MUTEX-LVE3HLP

Attributes

gencode
fGXp2YoV37aS
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

Processes:

MjqjvavSo.exe

pid	Process
1972	MjqjvavSo.exe

Loads dropped DLL 2 IoCs

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

pid	Process
1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MjqjvavSo.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Roaming\\Java.exe"	MjqjvavSo.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1760 set thread context of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

vbc.exeMjqjvavSo.exe496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MjqjvavSo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exevbc.exe

description	pid	Process
Token: SeDebugPrivilege	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2952	vbc.exe
Token: SeSecurityPrivilege	2952	vbc.exe
Token: SeTakeOwnershipPrivilege	2952	vbc.exe
Token: SeLoadDriverPrivilege	2952	vbc.exe
Token: SeSystemProfilePrivilege	2952	vbc.exe
Token: SeSystemtimePrivilege	2952	vbc.exe
Token: SeProfSingleProcessPrivilege	2952	vbc.exe
Token: SeIncBasePriorityPrivilege	2952	vbc.exe
Token: SeCreatePagefilePrivilege	2952	vbc.exe
Token: SeBackupPrivilege	2952	vbc.exe
Token: SeRestorePrivilege	2952	vbc.exe
Token: SeShutdownPrivilege	2952	vbc.exe
Token: SeDebugPrivilege	2952	vbc.exe
Token: SeSystemEnvironmentPrivilege	2952	vbc.exe
Token: SeChangeNotifyPrivilege	2952	vbc.exe
Token: SeRemoteShutdownPrivilege	2952	vbc.exe
Token: SeUndockPrivilege	2952	vbc.exe
Token: SeManageVolumePrivilege	2952	vbc.exe
Token: SeImpersonatePrivilege	2952	vbc.exe
Token: SeCreateGlobalPrivilege	2952	vbc.exe
Token: 33	2952	vbc.exe
Token: 34	2952	vbc.exe
Token: 35	2952	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid	Process
2952	vbc.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2952	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	30
PID 1760 wrote to memory of 1972	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	31
PID 1760 wrote to memory of 1972	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	31
PID 1760 wrote to memory of 1972	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	31
PID 1760 wrote to memory of 1972	1760	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2952
- C:\Users\Admin\AppData\Roaming\MjqjvavSo.exe
  "C:\Users\Admin\AppData\Roaming\MjqjvavSo.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MjqjvavSo.exe

Filesize
4KB

MD5
890e5b1e0c79f073ce5091cad4aa6452

SHA1
1f6f6c81b99539c5cd568f2dd37c5834b12174cd

SHA256
95bd537e7ea426bbdff936a15129ccb451474c2c9eeab176c4319b874a04fce3

SHA512
fe6f6a2deef89055eb10329d26fe45d8946dbef4eccec21cbc518bf0fad8f5727bf1386af014103eedf6b9e9c248fa956a1cf2de77cf50a6972c9b16fd01cd5d

Download Submit
memory/1760-1-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-2-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-0-0x00000000745F1000-0x00000000745F2000-memory.dmp

Filesize
4KB

Download
memory/1760-19-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/1972-18-0x00000000745F1000-0x00000000745F2000-memory.dmp

Filesize
4KB

Download
memory/1972-20-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2952-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-5-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-27-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2952-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads