darkcomet | 9976729594d039688a44ca338b3e2ce85a49b6730b2435e53c35e8318ea51f61

General

Target

532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe
Size

2.9MB
MD5

532354d2b4cbb389ec253e5291aa6534
SHA1

783512689f2e64965c48d215bebf24be9880cff1
SHA256

9976729594d039688a44ca338b3e2ce85a49b6730b2435e53c35e8318ea51f61
SHA512

0d0a3f3914289d8e4eb7f76e30eb6ea5b5ae57ac9b50b7fdc7fac74093c82fe379d4cc12a90c1ab426bc109a5575bcde05eb2cfd143964c6feb8210bd65da112
SSDEEP

49152:DsCO+CQ1xKRzgJGvCZOO5RoyeZA+MFjUksU2RbvpBnKvVq6fBpzM60VJupSQ3q:DsCO3oo3CZOkRdfjU7XbRBoVq6j0V4p0

Score

10^/10

darkcomet discovery rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid	Process
2852	Client.exe

Loads dropped DLL 1 IoCs

Processes:

532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe

pid	Process
2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2852-8-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/files/0x00090000000120fd-7.dat	upx
behavioral1/memory/2748-6-0x0000000003E90000-0x000000000450D000-memory.dmp	upx
behavioral1/memory/2852-9-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-10-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-13-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-15-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-18-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-21-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-24-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-27-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-29-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-32-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-34-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-37-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-40-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-42-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx
behavioral1/memory/2852-45-0x0000000000400000-0x0000000000A7D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exeClient.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

Client.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2852	Client.exe
Token: SeSecurityPrivilege	2852	Client.exe
Token: SeTakeOwnershipPrivilege	2852	Client.exe
Token: SeLoadDriverPrivilege	2852	Client.exe
Token: SeSystemProfilePrivilege	2852	Client.exe
Token: SeSystemtimePrivilege	2852	Client.exe
Token: SeProfSingleProcessPrivilege	2852	Client.exe
Token: SeIncBasePriorityPrivilege	2852	Client.exe
Token: SeCreatePagefilePrivilege	2852	Client.exe
Token: SeBackupPrivilege	2852	Client.exe
Token: SeRestorePrivilege	2852	Client.exe
Token: SeShutdownPrivilege	2852	Client.exe
Token: SeDebugPrivilege	2852	Client.exe
Token: SeSystemEnvironmentPrivilege	2852	Client.exe
Token: SeChangeNotifyPrivilege	2852	Client.exe
Token: SeRemoteShutdownPrivilege	2852	Client.exe
Token: SeUndockPrivilege	2852	Client.exe
Token: SeManageVolumePrivilege	2852	Client.exe
Token: SeImpersonatePrivilege	2852	Client.exe
Token: SeCreateGlobalPrivilege	2852	Client.exe
Token: 33	2852	Client.exe
Token: 34	2852	Client.exe
Token: 35	2852	Client.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Client.exe

pid	Process
2852	Client.exe
2852	Client.exe
2852	Client.exe
2852	Client.exe
2852	Client.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Client.exe

pid	Process
2852	Client.exe
2852	Client.exe
2852	Client.exe
2852	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid	Process
2852	Client.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2748 wrote to memory of 2852	2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2852	2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2852	2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2852	2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2852	2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2852	2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2852	2748	532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Roaming\Client.exe
  "C:\Users\Admin\AppData\Roaming\Client.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Client.exe

Filesize
3.0MB

MD5
7fd34db83f76f79177d2c6df0b87645a

SHA1
35621ee4133cd081fd67d3d18af41c827f5ddc7d

SHA256
1432cc3dc1c2f5de7eff82d833ab1948b9e660fe9f3f5134d5b692a61f42850a

SHA512
5c18502cf0110dfc2e379b25775b75bfc0ef1e639e2aaff4847344b1e3483a0eedbfd316d8662843a000a3611929f68b131374e3052bff1a7eab2d16343eef04

Download Submit
C:\Users\Admin\AppData\Roaming\config.ini

Filesize
20B

MD5
8bb400d926ed7f40be31fada430f45ea

SHA1
27826dc07859a23a11bcbd1317912de9593bb074

SHA256
68a10a393c2fe6e8e1f47bd3b42564456cf55a7fc881550b1d7dcc765462c405

SHA512
f84f346c73a5ddc1ab0c3484e20402b236f3bff186c0d45c38cb770acecb4d3a26a318d772007c298082f4111125cba9b2473a0bee38e0dfcb91e7d8b4c1e8a4

Download Submit
C:\Users\Admin\AppData\Roaming\config.ini

Filesize
20B

MD5
8b95c8c3b5a785465f8e2f868e20cc30

SHA1
2787db459289b44cde9107db26cbadc589883ce3

SHA256
976c786397ad5cd5f0d2ac8e96dc67bc904f3eeffa10d08bc2c975a213ebd041

SHA512
e51500409551a44b22582a1b8c3d5d25f5b708a0a443a714373da402b25f6a8044d0d2d39198ccc4b4729cb5c3cc68b201fbf164aded78054378291df09f7ac0

Download Submit
memory/2748-6-0x0000000003E90000-0x000000000450D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-13-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-9-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-15-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-18-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-21-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-24-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-10-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-8-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-27-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-29-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-32-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-34-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-37-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-40-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-42-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download
memory/2852-45-0x0000000000400000-0x0000000000A7D000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads