darkcomet | 901f0caa08f883123e4024e7f4c3df3967080d78af0cc012ee5f9efbc0b7737f

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe
Size

685KB
MD5

9548d12b1a7d6e3ea25cb1d4cbfcd815
SHA1

06f9a36a78d2605dd70467fd7a0a2789470874a1
SHA256

901f0caa08f883123e4024e7f4c3df3967080d78af0cc012ee5f9efbc0b7737f
SHA512

4c850bf3c95435fcdb0611170a26c4b578dcb82b5a931b72e7ed29b44c0eb63ef09aa0a4dd522daa4df7e4cdbea58389ce5d21cb9ce8b252001f045f3179f6aa
SSDEEP

12288:iLoty90ZUlnddqPI+cuMJgtk525ZRsoDwRnU4jUtdEJV1/U/XLhV+xxI1m6k/ze:PydddL+LEgGMZCoYUGUsV6XLamnu

Score

10^/10

darkcomet discovery persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	WHU-DU~1.EXE

Executes dropped EXE 1 IoCs

pid	Process
788	WHU-DU~1.EXE

Loads dropped DLL 3 IoCs

pid	Process
2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe
2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe
788	WHU-DU~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000016ab9-4.dat	upx
behavioral1/memory/2156-10-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-13-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-43-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-44-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-45-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-46-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-47-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-48-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-49-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-50-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-51-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-52-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-53-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-54-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-55-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-56-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/788-57-0x0000000013140000-0x00000000131FB000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WHU-DU~1.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WHU-DU~1.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WHU-DU~1.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WHU-DU~1.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WHU-DU~1.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	WHU-DU~1.EXE

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	788	WHU-DU~1.EXE
Token: SeSecurityPrivilege	788	WHU-DU~1.EXE
Token: SeTakeOwnershipPrivilege	788	WHU-DU~1.EXE
Token: SeLoadDriverPrivilege	788	WHU-DU~1.EXE
Token: SeSystemProfilePrivilege	788	WHU-DU~1.EXE
Token: SeSystemtimePrivilege	788	WHU-DU~1.EXE
Token: SeProfSingleProcessPrivilege	788	WHU-DU~1.EXE
Token: SeIncBasePriorityPrivilege	788	WHU-DU~1.EXE
Token: SeCreatePagefilePrivilege	788	WHU-DU~1.EXE
Token: SeBackupPrivilege	788	WHU-DU~1.EXE
Token: SeRestorePrivilege	788	WHU-DU~1.EXE
Token: SeShutdownPrivilege	788	WHU-DU~1.EXE
Token: SeDebugPrivilege	788	WHU-DU~1.EXE
Token: SeSystemEnvironmentPrivilege	788	WHU-DU~1.EXE
Token: SeChangeNotifyPrivilege	788	WHU-DU~1.EXE
Token: SeRemoteShutdownPrivilege	788	WHU-DU~1.EXE
Token: SeUndockPrivilege	788	WHU-DU~1.EXE
Token: SeManageVolumePrivilege	788	WHU-DU~1.EXE
Token: SeImpersonatePrivilege	788	WHU-DU~1.EXE
Token: SeCreateGlobalPrivilege	788	WHU-DU~1.EXE
Token: 33	788	WHU-DU~1.EXE
Token: 34	788	WHU-DU~1.EXE
Token: 35	788	WHU-DU~1.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 788	2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe	30
PID 2156 wrote to memory of 788	2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe	30
PID 2156 wrote to memory of 788	2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe	30
PID 2156 wrote to memory of 788	2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe	30
PID 2156 wrote to memory of 788	2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe	30
PID 2156 wrote to memory of 788	2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe	30
PID 2156 wrote to memory of 788	2156	9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe	30
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31
PID 788 wrote to memory of 2096	788	WHU-DU~1.EXE	31

C:\Users\Admin\AppData\Local\Temp\9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9548d12b1a7d6e3ea25cb1d4cbfcd815_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WHU-DU~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WHU-DU~1.EXE
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\SysWOW64\notepad.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\WHU-DU~1.EXE

Filesize
241KB

MD5
f5c538435ae89c42334628aca979d04f

SHA1
95d531225227446b930d3bcba129596e664899af

SHA256
c1bb5383d8cf4d2ab5fdda378a8fa168d031cfd1333ed0b2e126e9f4350229ce

SHA512
469b89129cfb8b5206e49b4fa775d39226c7ade024038385ec959dad7f3505f44dc66f286f1521f323b998a9a17ab3dc059478810494a47a32aa93524d24eca4

Download Submit
memory/788-52-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-55-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-13-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-46-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-56-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-43-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-44-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-48-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-57-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-47-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-45-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-49-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-50-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-51-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-54-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/788-53-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2096-42-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2096-16-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2156-11-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2156-10-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads