darkcomet | 33f13a29c8ecc5ad7056321e73aaf84217ec9ba685814fb34120b4f3ad6900dd

General

Target

8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Size

1.5MB
MD5

8c59df2671f68c6026ca254483bf189c
SHA1

7d9b000aff2e1230f912538784227f9dae811a16
SHA256

33f13a29c8ecc5ad7056321e73aaf84217ec9ba685814fb34120b4f3ad6900dd
SHA512

d5c5d53b2f54c74cbcaa27ba33c014d0228475a020057bf83ec259e78c00085ee7c7239339c25d50febbad568367c72a28d6be5b2c77c3ee3f46d63e5f5db903
SSDEEP

24576:oRmJkcoQricOIQxiZY1iafBWtL/YerMytPZyyJ7:NJZoQrbTFZY1iafBWBYSBJ7

Score

10^/10

darkcomet latentbot msconfig32 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Msconfig32

C2

greatgiggles.zapto.org:9001

Mutex

DC_MUTEX-EAB1BX6

Attributes

gencode
TQgQFlfVslb7
install
false
offline_keylogger
true
persistence
false

Extracted

Family

latentbot

C2

greatgiggles.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\config.exe	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\config.exe	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeSecurityPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeBackupPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeRestorePrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeShutdownPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeDebugPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeUndockPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: 33	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: 34	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
Token: 35	2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2500	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3016	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	30
PID 2600 wrote to memory of 3016	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	30
PID 2600 wrote to memory of 3016	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	30
PID 2600 wrote to memory of 3016	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2500	2600	8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8c59df2671f68c6026ca254483bf189c_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a.vbs

Filesize
9KB

MD5
f2764287e75f3aec142e6195cb330b3e

SHA1
6cdb779c5681861c95529a311d26c28d36411e05

SHA256
c93035ec22ec0a8bcdb1a5dc167d9a0130b3243faf2bea0e1abc6308fdf727ef

SHA512
c7cee9e6df90f5817ebae3004964b7c496c2dc5a872e16a80b8256c441128c77d81e623ff69668c8456e43ac36563d0ad8858ebdda7ca1ec5e0c97c8d8dc81e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ensambla.txt

Filesize
2KB

MD5
992dea548be8314039a109d8f0725578

SHA1
dbfbb7268164b58f27bc4650158312058573ac32

SHA256
9a186fead0270c923d4672ed89b898f9210cfd59837ab1fbdc82987a61378cec

SHA512
52c22415a7f0cafa1d42163873fb46e8f02a081e9edda7a51c02be87a5c0550e3eebba4f697b33d6e62bf42a79f1cbcb75f281d2cc0dc2a78e6a8e933da20577

Download Submit
memory/2500-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-39-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-38-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-36-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-34-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2500-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-37-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-40-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-41-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-43-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-44-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-45-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-46-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-47-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-48-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-49-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-50-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-51-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-52-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-53-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-54-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2500-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads