darkcomet | 23f39695770b7c07bc16ac3197fa1a3c3a519b0d806a89cfb40de19e4d043c45

General

Target

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
Size

843KB
MD5

9e70af75e6bf4c28505472372958fe33
SHA1

4c5ffd17637fc86520c9c1f8f29711ce267cbdba
SHA256

23f39695770b7c07bc16ac3197fa1a3c3a519b0d806a89cfb40de19e4d043c45
SHA512

67ffac1822af413fda09bc60ab26a772c7358b7d1f57c48ddbaba54e29698cdb9c10f3f1886a2e303c3646db46a1e5031b55a26b639e96c21a91cc6ec8f9c1cc
SSDEEP

24576:AkWAAuqpyEtwEtwc07EAcraLSndbMlE2FBrUoPj38a:AJyEjk7Er0Sn6lHbr3Pj38a

Score

10^/10

darkcomet discovery rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

system.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	system.exe

Drops startup file 1 IoCs

Processes:

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.lnk	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

system.exesystem.exe

pid	Process
3052	system.exe
2696	system.exe

Loads dropped DLL 4 IoCs

Processes:

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exesystem.exe

pid	Process
2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
3052	system.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

system.exe

description	pid	Process	procid_target
PID 3052 set thread context of 2696	3052	system.exe	31

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2696-39-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/2696-36-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/2696-34-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/2696-49-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/2696-48-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/2696-47-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/2696-46-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral1/memory/2696-45-0x0000000013140000-0x00000000131FB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exesystem.exesystem.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

system.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	system.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	system.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

system.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	system.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

system.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2696	system.exe
Token: SeSecurityPrivilege	2696	system.exe
Token: SeTakeOwnershipPrivilege	2696	system.exe
Token: SeLoadDriverPrivilege	2696	system.exe
Token: SeSystemProfilePrivilege	2696	system.exe
Token: SeSystemtimePrivilege	2696	system.exe
Token: SeProfSingleProcessPrivilege	2696	system.exe
Token: SeIncBasePriorityPrivilege	2696	system.exe
Token: SeCreatePagefilePrivilege	2696	system.exe
Token: SeBackupPrivilege	2696	system.exe
Token: SeRestorePrivilege	2696	system.exe
Token: SeShutdownPrivilege	2696	system.exe
Token: SeDebugPrivilege	2696	system.exe
Token: SeSystemEnvironmentPrivilege	2696	system.exe
Token: SeChangeNotifyPrivilege	2696	system.exe
Token: SeRemoteShutdownPrivilege	2696	system.exe
Token: SeUndockPrivilege	2696	system.exe
Token: SeManageVolumePrivilege	2696	system.exe
Token: SeImpersonatePrivilege	2696	system.exe
Token: SeCreateGlobalPrivilege	2696	system.exe
Token: 33	2696	system.exe
Token: 34	2696	system.exe
Token: 35	2696	system.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

system.exe

pid	Process
3052	system.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exesystem.exe

description	pid	Process	procid_target
PID 2976 wrote to memory of 3052	2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	30
PID 2976 wrote to memory of 3052	2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	30
PID 2976 wrote to memory of 3052	2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	30
PID 2976 wrote to memory of 3052	2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	30
PID 2976 wrote to memory of 3052	2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	30
PID 2976 wrote to memory of 3052	2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	30
PID 2976 wrote to memory of 3052	2976	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31
PID 3052 wrote to memory of 2696	3052	system.exe	31

C:\Users\Admin\AppData\Local\Temp\9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\system.exe
  "C:\Users\Admin\AppData\Local\Temp\system.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\system.exe
    C:\Users\Admin\AppData\Local\Temp\system.exe
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\system.exe

Filesize
588KB

MD5
10894b269f51460e3014eb14d0361b34

SHA1
81e5813a7f3aa76d65d54f465d4aa0a3cb2b6c24

SHA256
bbe499d9d7fc61237cbd0d22d361e852b79bebe930977880f2be00d082ca876a

SHA512
ca1d5e8e2f3af72dfbfd5912928c858cba22a36c6ba6ebe7721eee0703921ad517f78a0a6d1b487fdda87117c835099684a51df6d6a5ed932abfa9c019be21f3

Download Submit
memory/2696-42-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2696-45-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-46-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-47-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-48-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-49-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-39-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-34-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-36-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/2696-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2976-16-0x0000000003340000-0x00000000033FB000-memory.dmp

Filesize
748KB

Download
memory/2976-15-0x0000000003340000-0x00000000033FB000-memory.dmp

Filesize
748KB

Download
memory/2976-7-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/3052-25-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-23-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-26-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-27-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-41-0x0000000004900000-0x00000000049BB000-memory.dmp

Filesize
748KB

Download
memory/3052-29-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-30-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-28-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-19-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/3052-20-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-18-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3052-44-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads