darkcomet | 3e6b574ae73a735fde06db712e8c7f2d767e14acba572942ff4b9a2553c557b2

General

Target

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
Size

1.0MB
MD5

496b3e5f673f5407ea4a55c1d17736a5
SHA1

be6b5eae60384d6c99011f003a277c0c3031bc80
SHA256

3e6b574ae73a735fde06db712e8c7f2d767e14acba572942ff4b9a2553c557b2
SHA512

2531dc8457f9001a73b451a9fd3a0f93e56fcc77114f14a13c7ddfcb70fdab3b95c50cdeb1c8dd0fc2b8889347d022e4abd13512b077f5daae12449b0ea487d1
SSDEEP

12288:K9DlmwWmfA71dcgvP7OimiRTH54nqosMbkf8Jyiebft56QcC4Ty089SI3l87d4pZ:0NA1xFRNJo7PU5IPalY7TB4EMj8B

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

jesusmanwoohoo.no-ip.org:1604

Mutex

DC_MUTEX-LVE3HLP

Attributes

gencode
fGXp2YoV37aS
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

MjqjvavSo.exe

pid	Process
5016	MjqjvavSo.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MjqjvavSo.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Roaming\\Java.exe"	MjqjvavSo.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3888 set thread context of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exevbc.exeMjqjvavSo.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MjqjvavSo.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exevbc.exe

description	pid	Process
Token: SeDebugPrivilege	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	452	vbc.exe
Token: SeSecurityPrivilege	452	vbc.exe
Token: SeTakeOwnershipPrivilege	452	vbc.exe
Token: SeLoadDriverPrivilege	452	vbc.exe
Token: SeSystemProfilePrivilege	452	vbc.exe
Token: SeSystemtimePrivilege	452	vbc.exe
Token: SeProfSingleProcessPrivilege	452	vbc.exe
Token: SeIncBasePriorityPrivilege	452	vbc.exe
Token: SeCreatePagefilePrivilege	452	vbc.exe
Token: SeBackupPrivilege	452	vbc.exe
Token: SeRestorePrivilege	452	vbc.exe
Token: SeShutdownPrivilege	452	vbc.exe
Token: SeDebugPrivilege	452	vbc.exe
Token: SeSystemEnvironmentPrivilege	452	vbc.exe
Token: SeChangeNotifyPrivilege	452	vbc.exe
Token: SeRemoteShutdownPrivilege	452	vbc.exe
Token: SeUndockPrivilege	452	vbc.exe
Token: SeManageVolumePrivilege	452	vbc.exe
Token: SeImpersonatePrivilege	452	vbc.exe
Token: SeCreateGlobalPrivilege	452	vbc.exe
Token: 33	452	vbc.exe
Token: 34	452	vbc.exe
Token: 35	452	vbc.exe
Token: 36	452	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid	Process
452	vbc.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 452	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	87
PID 3888 wrote to memory of 5016	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	88
PID 3888 wrote to memory of 5016	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	88
PID 3888 wrote to memory of 5016	3888	496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:452
- C:\Users\Admin\AppData\Roaming\MjqjvavSo.exe
  "C:\Users\Admin\AppData\Roaming\MjqjvavSo.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MjqjvavSo.exe

Filesize
4KB

MD5
890e5b1e0c79f073ce5091cad4aa6452

SHA1
1f6f6c81b99539c5cd568f2dd37c5834b12174cd

SHA256
95bd537e7ea426bbdff936a15129ccb451474c2c9eeab176c4319b874a04fce3

SHA512
fe6f6a2deef89055eb10329d26fe45d8946dbef4eccec21cbc518bf0fad8f5727bf1386af014103eedf6b9e9c248fa956a1cf2de77cf50a6972c9b16fd01cd5d

Download Submit
memory/452-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-7-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-41-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-8-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-9-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-38-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-36-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-35-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-6-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-33-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-29-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/452-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3888-0-0x0000000074C32000-0x0000000074C33000-memory.dmp

Filesize
4KB

Download
memory/3888-2-0x0000000074C30000-0x00000000751E1000-memory.dmp

Filesize
5.7MB

Download
memory/3888-1-0x0000000074C30000-0x00000000751E1000-memory.dmp

Filesize
5.7MB

Download
memory/3888-26-0x0000000074C30000-0x00000000751E1000-memory.dmp

Filesize
5.7MB

Download
memory/5016-30-0x0000000074C30000-0x00000000751E1000-memory.dmp

Filesize
5.7MB

Download
memory/5016-27-0x0000000074C30000-0x00000000751E1000-memory.dmp

Filesize
5.7MB

Download
memory/5016-25-0x0000000074C30000-0x00000000751E1000-memory.dmp

Filesize
5.7MB

Download
memory/5016-22-0x0000000074C32000-0x0000000074C33000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads