darkcomet | d6df64bbc9873e60a38dfb6ff3fe0a3d0763167e07b84279ba328860d48cd4e9

General

Target

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Size

886KB
MD5

8f58c94ece1bace4e3eac74c51950fcc
SHA1

a95f0b844701f05054b7382be6aa7888498a2626
SHA256

d6df64bbc9873e60a38dfb6ff3fe0a3d0763167e07b84279ba328860d48cd4e9
SHA512

dfaafd564837b4f2466b0215de21234c8ac82057ebec19fa2479b590fb774aa361ca2dc2e1a0142599ae302ddfb2b9dffb68750192912647f29949684bf4a862
SSDEEP

12288:xXZFfk9Qc45ejXv1LvwrNIlcH/OohtdtYTZqgA9Yrs5WCTj4LXynXyLLlQ:Vvk9Q9er9jw56cH/Ntdt/gcY45WC/rE

Score

10^/10

darkcomet torrent discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

torrent

C2

xstf.servegame.com:12333

Mutex

DC_MUTEX-QFZLF9C

Attributes

InstallPath
My Torrents\torrent.exe
gencode
pCFNmbgnqzps
install
true
offline_keylogger
true
password
xsTFyRVa37890
persistence
false
reg_key
torrent

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\My Torrents\\torrent.exe"	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

torrent.exetorrent.exe

pid process

1476 torrent.exe
400 torrent.exe

pid	process
1476	torrent.exe
400	torrent.exe

Molebox Virtualization software 1 IoCs

Detects file using Molebox Virtualization software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\My Torrents\torrent.exe	molebox

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\torrent = "C:\\Users\\Admin\\AppData\\Roaming\\My Torrents\\torrent.exe"	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exetorrent.exe

description	pid	process	target process
PID 1720 set thread context of 3140	1720	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
PID 1476 set thread context of 400	1476	torrent.exe	torrent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exetorrent.exetorrent.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	torrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	torrent.exe

Modifies registry class 1 IoCs

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exetorrent.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeSecurityPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeBackupPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeRestorePrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeShutdownPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeDebugPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeUndockPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: 33	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: 34	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: 35	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: 36	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	400	torrent.exe
Token: SeSecurityPrivilege	400	torrent.exe
Token: SeTakeOwnershipPrivilege	400	torrent.exe
Token: SeLoadDriverPrivilege	400	torrent.exe
Token: SeSystemProfilePrivilege	400	torrent.exe
Token: SeSystemtimePrivilege	400	torrent.exe
Token: SeProfSingleProcessPrivilege	400	torrent.exe
Token: SeIncBasePriorityPrivilege	400	torrent.exe
Token: SeCreatePagefilePrivilege	400	torrent.exe
Token: SeBackupPrivilege	400	torrent.exe
Token: SeRestorePrivilege	400	torrent.exe
Token: SeShutdownPrivilege	400	torrent.exe
Token: SeDebugPrivilege	400	torrent.exe
Token: SeSystemEnvironmentPrivilege	400	torrent.exe
Token: SeChangeNotifyPrivilege	400	torrent.exe
Token: SeRemoteShutdownPrivilege	400	torrent.exe
Token: SeUndockPrivilege	400	torrent.exe
Token: SeManageVolumePrivilege	400	torrent.exe
Token: SeImpersonatePrivilege	400	torrent.exe
Token: SeCreateGlobalPrivilege	400	torrent.exe
Token: 33	400	torrent.exe
Token: 34	400	torrent.exe
Token: 35	400	torrent.exe
Token: 36	400	torrent.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

torrent.exe

pid process

400 torrent.exe

pid	process
400	torrent.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exetorrent.exe

description	pid	process	target process
PID 1720 wrote to memory of 3140	1720	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
PID 1720 wrote to memory of 3140	1720	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
PID 1720 wrote to memory of 3140	1720	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
PID 1720 wrote to memory of 3140	1720	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
PID 1720 wrote to memory of 3140	1720	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
PID 3140 wrote to memory of 1476	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	torrent.exe
PID 3140 wrote to memory of 1476	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	torrent.exe
PID 3140 wrote to memory of 1476	3140	8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe	torrent.exe
PID 1476 wrote to memory of 400	1476	torrent.exe	torrent.exe
PID 1476 wrote to memory of 400	1476	torrent.exe	torrent.exe
PID 1476 wrote to memory of 400	1476	torrent.exe	torrent.exe
PID 1476 wrote to memory of 400	1476	torrent.exe	torrent.exe
PID 1476 wrote to memory of 400	1476	torrent.exe	torrent.exe

C:\Users\Admin\AppData\Local\Temp\8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Users\Admin\AppData\Roaming\My Torrents\torrent.exe
    "C:\Users\Admin\AppData\Roaming\My Torrents\torrent.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Users\Admin\AppData\Roaming\My Torrents\torrent.exe
      "C:\Users\Admin\AppData\Roaming\My Torrents\torrent.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\My Torrents\torrent.exe

Filesize
886KB

MD5
8f58c94ece1bace4e3eac74c51950fcc

SHA1
a95f0b844701f05054b7382be6aa7888498a2626

SHA256
d6df64bbc9873e60a38dfb6ff3fe0a3d0763167e07b84279ba328860d48cd4e9

SHA512
dfaafd564837b4f2466b0215de21234c8ac82057ebec19fa2479b590fb774aa361ca2dc2e1a0142599ae302ddfb2b9dffb68750192912647f29949684bf4a862

Download Submit
memory/400-54-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-53-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-47-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-48-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-49-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-50-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-51-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-52-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/400-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3140-3-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3140-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3140-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3140-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3140-5-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3140-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads