darkcomet | 142421d1eaa3e5646bb19a7bb87660fc8c6be15e7af505e0839d80d59cad977d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59ce2e68ccd1fdbb0c72133107f41db2_JaffaCakes118.exe
Size

1.3MB
MD5

59ce2e68ccd1fdbb0c72133107f41db2
SHA1

1c1a83a99a35a17806df2297393ef47fb1bb03cc
SHA256

142421d1eaa3e5646bb19a7bb87660fc8c6be15e7af505e0839d80d59cad977d
SHA512

f07f79770d2c0b9070d2f60bb4b76e28fd1a78276d3394bd2fef98ca1cd5b357e0e51ab5eb7073c3312e9460798d97fe6fdd351858308c60a71f7b3663b9f1c8
SSDEEP

24576:oSUsVKJLgkWBKHMu4OCJvgBJBTIqfcEA8E67q7wvQemcMzQhRF:vU1JouleJscsE6M+u0F

Score

10^/10

darkcomet rat discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Rat

guywithsockz.no-ip.org:1605

Mutex

DC_MUTEX-AXS9XA8

Attributes

gencode
mNEJsHvfQMfx
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	59ce2e68ccd1fdbb0c72133107f41db2_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4304	Photo.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4304 set thread context of 3644	4304	Photo.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3644	vbc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3644	vbc.exe
Token: SeSecurityPrivilege	3644	vbc.exe
Token: SeTakeOwnershipPrivilege	3644	vbc.exe
Token: SeLoadDriverPrivilege	3644	vbc.exe
Token: SeSystemProfilePrivilege	3644	vbc.exe
Token: SeSystemtimePrivilege	3644	vbc.exe
Token: SeProfSingleProcessPrivilege	3644	vbc.exe
Token: SeIncBasePriorityPrivilege	3644	vbc.exe
Token: SeCreatePagefilePrivilege	3644	vbc.exe
Token: SeBackupPrivilege	3644	vbc.exe
Token: SeRestorePrivilege	3644	vbc.exe
Token: SeShutdownPrivilege	3644	vbc.exe
Token: SeDebugPrivilege	3644	vbc.exe
Token: SeSystemEnvironmentPrivilege	3644	vbc.exe
Token: SeChangeNotifyPrivilege	3644	vbc.exe
Token: SeRemoteShutdownPrivilege	3644	vbc.exe
Token: SeUndockPrivilege	3644	vbc.exe
Token: SeManageVolumePrivilege	3644	vbc.exe
Token: SeImpersonatePrivilege	3644	vbc.exe
Token: SeCreateGlobalPrivilege	3644	vbc.exe
Token: 33	3644	vbc.exe
Token: 34	3644	vbc.exe
Token: 35	3644	vbc.exe
Token: 36	3644	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3644	vbc.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4304	4648	59ce2e68ccd1fdbb0c72133107f41db2_JaffaCakes118.exe	87
PID 4648 wrote to memory of 4304	4648	59ce2e68ccd1fdbb0c72133107f41db2_JaffaCakes118.exe	87
PID 4648 wrote to memory of 4304	4648	59ce2e68ccd1fdbb0c72133107f41db2_JaffaCakes118.exe	87
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 4304 wrote to memory of 3644	4304	Photo.exe	88
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89
PID 3644 wrote to memory of 4188	3644	vbc.exe	89

C:\Users\Admin\AppData\Local\Temp\59ce2e68ccd1fdbb0c72133107f41db2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59ce2e68ccd1fdbb0c72133107f41db2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\Photo.exe
  "C:\Users\Admin\AppData\Local\Temp\Photo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      System Location Discovery: System Language Discovery
      PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Photo.exe

Filesize
1.2MB

MD5
d53bb656adf8e860d59bcc537c9316d8

SHA1
12aef15ff470448ef0963ffafc045991076a590e

SHA256
a1ff358176c94e1b844445ef7fc40e8dde4a58c0c3e0361f8878f68d8fe6a9b4

SHA512
5b10af0a84a776e9780b28b3ef4a705b9234c09a5b35c2044b9dc6a66b00b825ac358ed31b05d926120a466154eabfe3f039de180cd4d5f9a4b45af7127e4a13

Download Submit
memory/3644-40-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-51-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-50-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-49-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-48-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-47-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-46-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-45-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-44-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-43-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-25-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-41-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-39-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-34-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-38-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-35-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-36-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-37-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4188-33-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/4304-29-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download
memory/4304-24-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download
memory/4304-22-0x0000000074C42000-0x0000000074C43000-memory.dmp

Filesize
4KB

Download
memory/4304-23-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download
memory/4648-0-0x00007FFB69A55000-0x00007FFB69A56000-memory.dmp

Filesize
4KB

Download
memory/4648-21-0x00007FFB697A0000-0x00007FFB6A141000-memory.dmp

Filesize
9.6MB

Download
memory/4648-7-0x000000001C850000-0x000000001C89C000-memory.dmp

Filesize
304KB

Download
memory/4648-1-0x000000001BB50000-0x000000001BBF6000-memory.dmp

Filesize
664KB

Download
memory/4648-3-0x000000001C0D0000-0x000000001C59E000-memory.dmp

Filesize
4.8MB

Download
memory/4648-6-0x000000001BA80000-0x000000001BA88000-memory.dmp

Filesize
32KB

Download
memory/4648-5-0x00007FFB697A0000-0x00007FFB6A141000-memory.dmp

Filesize
9.6MB

Download
memory/4648-4-0x000000001C6F0000-0x000000001C78C000-memory.dmp

Filesize
624KB

Download
memory/4648-2-0x00007FFB697A0000-0x00007FFB6A141000-memory.dmp

Filesize
9.6MB

Download