darkcomet | d5e88ba5e7751149f6fa84a4d71566c4051b6176095ab0f7e8a4fce6ef6a11ec

General

Target

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe
Size

709KB
MD5

59c3fa30d3e9d542695592a1f80e67ad
SHA1

2a65d2e8bdb5e84c42d64e7e67181cfa53554ca0
SHA256

d5e88ba5e7751149f6fa84a4d71566c4051b6176095ab0f7e8a4fce6ef6a11ec
SHA512

db769c8f4473f91a1b596d90ee6151d7fff0c4d90cbca12cc8d2bc2176441704da4674671f91646e34c4f28d96b33b1c0ccbf594a21314418fa1f30a8a63cbd1
SSDEEP

12288:3shOpw7EzATP/8uKONAgon+Ne3b4eo08uTx05Dn+YE1RK84dpE7OU0Z1nSIR3Qc:3shODsTXKONAB+e4e19vY8K8eE7OU0ZU

Score

10^/10

darkcomet a asept 01 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

A Asept 01

C2

metafunn2.no-ip.biz:1332

Mutex

DC_MUTEX-6AMDZDL

Attributes

gencode
c6tH54LB6sTc
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

tmp6FE0.tmp.exetmp6FE0.tmp.exe

pid	Process
4232	tmp6FE0.tmp.exe
1780	tmp6FE0.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tmp6FE0.tmp.exetmp6FE0.tmp.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\391867976 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6FE0.tmp.exe\""	tmp6FE0.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\14296212 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6FE0.tmp.exe\""	tmp6FE0.tmp.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4492 set thread context of 1840	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	91

Drops file in Windows directory 3 IoCs

Processes:

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exetmp6FE0.tmp.exetmp6FE0.tmp.exevbc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6FE0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6FE0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exetmp6FE0.tmp.exetmp6FE0.tmp.exevbc.exe

description	pid	Process
Token: SeDebugPrivilege	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe
Token: SeDebugPrivilege	4232	tmp6FE0.tmp.exe
Token: SeDebugPrivilege	1780	tmp6FE0.tmp.exe
Token: SeIncreaseQuotaPrivilege	1840	vbc.exe
Token: SeSecurityPrivilege	1840	vbc.exe
Token: SeTakeOwnershipPrivilege	1840	vbc.exe
Token: SeLoadDriverPrivilege	1840	vbc.exe
Token: SeSystemProfilePrivilege	1840	vbc.exe
Token: SeSystemtimePrivilege	1840	vbc.exe
Token: SeProfSingleProcessPrivilege	1840	vbc.exe
Token: SeIncBasePriorityPrivilege	1840	vbc.exe
Token: SeCreatePagefilePrivilege	1840	vbc.exe
Token: SeBackupPrivilege	1840	vbc.exe
Token: SeRestorePrivilege	1840	vbc.exe
Token: SeShutdownPrivilege	1840	vbc.exe
Token: SeDebugPrivilege	1840	vbc.exe
Token: SeSystemEnvironmentPrivilege	1840	vbc.exe
Token: SeChangeNotifyPrivilege	1840	vbc.exe
Token: SeRemoteShutdownPrivilege	1840	vbc.exe
Token: SeUndockPrivilege	1840	vbc.exe
Token: SeManageVolumePrivilege	1840	vbc.exe
Token: SeImpersonatePrivilege	1840	vbc.exe
Token: SeCreateGlobalPrivilege	1840	vbc.exe
Token: 33	1840	vbc.exe
Token: 34	1840	vbc.exe
Token: 35	1840	vbc.exe
Token: 36	1840	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid	Process
1840	vbc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4492 wrote to memory of 4232	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	89
PID 4492 wrote to memory of 4232	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	89
PID 4492 wrote to memory of 4232	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	89
PID 4492 wrote to memory of 1780	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	90
PID 4492 wrote to memory of 1780	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	90
PID 4492 wrote to memory of 1780	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	90
PID 4492 wrote to memory of 1840	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	91
PID 4492 wrote to memory of 1840	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	91
PID 4492 wrote to memory of 1840	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	91
PID 4492 wrote to memory of 1840	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	91
PID 4492 wrote to memory of 1840	4492	59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59c3fa30d3e9d542695592a1f80e67ad_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\tmp6FE0.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6FE0.tmp.exe" -p
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\tmp6FE0.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6FE0.tmp.exe" -p
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tmp6FE0.tmp.exe.log

Filesize
217B

MD5
594f9a7c2c9174efbb2099b6b21ca0c1

SHA1
859abbb672399e195267d2ebd57395ae9153dcd0

SHA256
3f56509adf13b45203567538dcd316e5217122182ff5b051da5ea2edc6bbc9a7

SHA512
13680a4fb1d115efb80d1fc2888420c48af6429360b6d14d77a60ed57d15c29233f424955e4b840a131d40881507b1465beeac1aa258b6ca20d311a668240b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6FE0.tmp.exe

Filesize
709KB

MD5
59c3fa30d3e9d542695592a1f80e67ad

SHA1
2a65d2e8bdb5e84c42d64e7e67181cfa53554ca0

SHA256
d5e88ba5e7751149f6fa84a4d71566c4051b6176095ab0f7e8a4fce6ef6a11ec

SHA512
db769c8f4473f91a1b596d90ee6151d7fff0c4d90cbca12cc8d2bc2176441704da4674671f91646e34c4f28d96b33b1c0ccbf594a21314418fa1f30a8a63cbd1

Download Submit
memory/1780-24-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/1780-21-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/1780-20-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/1840-36-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-32-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-33-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-35-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-31-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-37-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-38-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-34-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-25-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-26-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-27-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-28-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-29-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1840-30-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4232-15-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4232-17-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4232-14-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4232-13-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4492-23-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4492-0-0x00000000750A2000-0x00000000750A3000-memory.dmp

Filesize
4KB

Download
memory/4492-2-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4492-1-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads