darkcomet | 948d08f4f06424bc8e0414ca7e6bbbe7ee5d864f7d8f3a712b74cd69caaad6a8

Analysis

max time kernel
135s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/10/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Size

747KB
MD5

6bc69964a238f1382f4b0d8ce2fd7029
SHA1

2eea26e5197cde6fc2824384d215ed71a12b41d5
SHA256

948d08f4f06424bc8e0414ca7e6bbbe7ee5d864f7d8f3a712b74cd69caaad6a8
SHA512

80e6e7f9b79e0469481f07625fb82c02c0769805a4dfe18941ef34dd092b8e28e9a2fda4aaed2e0a92574f3f8757cc7c91140699038b0c9def298fe200b63d00
SSDEEP

12288:nk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/++vvNVRV:k0QRWoJEfg0oChGdJQbjPbNW5tYeP+GZ

Score

10^/10

darkcomet guest16 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

68.38.146.161:82

Mutex

DC_MUTEX-KU2FVVH

Attributes

gencode
lEVZBA6zkcff
install
false
offline_keylogger
true
password
123456
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2764 set thread context of 2700	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeSecurityPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeBackupPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeRestorePrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeShutdownPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeDebugPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeUndockPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: 33	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: 34	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: 35	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2700	iexplore.exe
Token: SeSecurityPrivilege	2700	iexplore.exe
Token: SeTakeOwnershipPrivilege	2700	iexplore.exe
Token: SeLoadDriverPrivilege	2700	iexplore.exe
Token: SeSystemProfilePrivilege	2700	iexplore.exe
Token: SeSystemtimePrivilege	2700	iexplore.exe
Token: SeProfSingleProcessPrivilege	2700	iexplore.exe
Token: SeIncBasePriorityPrivilege	2700	iexplore.exe
Token: SeCreatePagefilePrivilege	2700	iexplore.exe
Token: SeBackupPrivilege	2700	iexplore.exe
Token: SeRestorePrivilege	2700	iexplore.exe
Token: SeShutdownPrivilege	2700	iexplore.exe
Token: SeDebugPrivilege	2700	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2700	iexplore.exe
Token: SeChangeNotifyPrivilege	2700	iexplore.exe
Token: SeRemoteShutdownPrivilege	2700	iexplore.exe
Token: SeUndockPrivilege	2700	iexplore.exe
Token: SeManageVolumePrivilege	2700	iexplore.exe
Token: SeImpersonatePrivilege	2700	iexplore.exe
Token: SeCreateGlobalPrivilege	2700	iexplore.exe
Token: 33	2700	iexplore.exe
Token: 34	2700	iexplore.exe
Token: 35	2700	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2700	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2700	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2700	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2700	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2700	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2700	2764	6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6bc69964a238f1382f4b0d8ce2fd7029_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-1-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/2764-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2764-2-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download