darkcomet | 23f39695770b7c07bc16ac3197fa1a3c3a519b0d806a89cfb40de19e4d043c45

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
Size

843KB
MD5

9e70af75e6bf4c28505472372958fe33
SHA1

4c5ffd17637fc86520c9c1f8f29711ce267cbdba
SHA256

23f39695770b7c07bc16ac3197fa1a3c3a519b0d806a89cfb40de19e4d043c45
SHA512

67ffac1822af413fda09bc60ab26a772c7358b7d1f57c48ddbaba54e29698cdb9c10f3f1886a2e303c3646db46a1e5031b55a26b639e96c21a91cc6ec8f9c1cc
SSDEEP

24576:AkWAAuqpyEtwEtwc07EAcraLSndbMlE2FBrUoPj38a:AJyEjk7Er0Sn6lHbr3Pj38a

Score

10^/10

darkcomet discovery rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

system.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	system.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

Drops startup file 1 IoCs

Processes:

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.lnk	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

system.exesystem.exe

pid	Process
1744	system.exe
4536	system.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

system.exe

description	pid	Process	procid_target
PID 1744 set thread context of 4536	1744	system.exe	82

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4536-70-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/4536-74-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/4536-75-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/4536-76-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/4536-77-0x0000000013140000-0x00000000131FB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

system.exesystem.exe9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

system.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	system.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	system.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

system.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	system.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

system.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4536	system.exe
Token: SeSecurityPrivilege	4536	system.exe
Token: SeTakeOwnershipPrivilege	4536	system.exe
Token: SeLoadDriverPrivilege	4536	system.exe
Token: SeSystemProfilePrivilege	4536	system.exe
Token: SeSystemtimePrivilege	4536	system.exe
Token: SeProfSingleProcessPrivilege	4536	system.exe
Token: SeIncBasePriorityPrivilege	4536	system.exe
Token: SeCreatePagefilePrivilege	4536	system.exe
Token: SeBackupPrivilege	4536	system.exe
Token: SeRestorePrivilege	4536	system.exe
Token: SeShutdownPrivilege	4536	system.exe
Token: SeDebugPrivilege	4536	system.exe
Token: SeSystemEnvironmentPrivilege	4536	system.exe
Token: SeChangeNotifyPrivilege	4536	system.exe
Token: SeRemoteShutdownPrivilege	4536	system.exe
Token: SeUndockPrivilege	4536	system.exe
Token: SeManageVolumePrivilege	4536	system.exe
Token: SeImpersonatePrivilege	4536	system.exe
Token: SeCreateGlobalPrivilege	4536	system.exe
Token: 33	4536	system.exe
Token: 34	4536	system.exe
Token: 35	4536	system.exe
Token: 36	4536	system.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

system.exe

pid	Process
1744	system.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exesystem.exe

description	pid	Process	procid_target
PID 3648 wrote to memory of 1744	3648	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	81
PID 3648 wrote to memory of 1744	3648	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	81
PID 3648 wrote to memory of 1744	3648	9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe	81
PID 1744 wrote to memory of 4536	1744	system.exe	82
PID 1744 wrote to memory of 4536	1744	system.exe	82
PID 1744 wrote to memory of 4536	1744	system.exe	82
PID 1744 wrote to memory of 4536	1744	system.exe	82
PID 1744 wrote to memory of 4536	1744	system.exe	82
PID 1744 wrote to memory of 4536	1744	system.exe	82
PID 1744 wrote to memory of 4536	1744	system.exe	82
PID 1744 wrote to memory of 4536	1744	system.exe	82

C:\Users\Admin\AppData\Local\Temp\9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e70af75e6bf4c28505472372958fe33_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\system.exe
  "C:\Users\Admin\AppData\Local\Temp\system.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\system.exe
    C:\Users\Admin\AppData\Local\Temp\system.exe
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\system.exe

Filesize
588KB

MD5
10894b269f51460e3014eb14d0361b34

SHA1
81e5813a7f3aa76d65d54f465d4aa0a3cb2b6c24

SHA256
bbe499d9d7fc61237cbd0d22d361e852b79bebe930977880f2be00d082ca876a

SHA512
ca1d5e8e2f3af72dfbfd5912928c858cba22a36c6ba6ebe7721eee0703921ad517f78a0a6d1b487fdda87117c835099684a51df6d6a5ed932abfa9c019be21f3

Download Submit
memory/1744-15-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1744-17-0x0000000002150000-0x00000000021B0000-memory.dmp

Filesize
384KB

Download
memory/1744-25-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-24-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/1744-23-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1744-22-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/1744-21-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1744-20-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/1744-19-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1744-18-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1744-26-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-38-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/1744-65-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1744-64-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/1744-63-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/1744-62-0x00000000039F0000-0x00000000039F2000-memory.dmp

Filesize
8KB

Download
memory/1744-61-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-60-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-58-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/1744-57-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/1744-56-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/1744-69-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/1744-68-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/1744-55-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-54-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-53-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-52-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-50-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-49-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/1744-48-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/1744-47-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/1744-46-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/1744-45-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/1744-44-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1744-43-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1744-42-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download
memory/1744-41-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/1744-40-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/1744-39-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/1744-37-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-36-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-35-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-34-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-33-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-31-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-30-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-29-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-28-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/1744-27-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-59-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-51-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-32-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1744-73-0x0000000002150000-0x00000000021B0000-memory.dmp

Filesize
384KB

Download
memory/1744-72-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4536-70-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/4536-74-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/4536-75-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/4536-76-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/4536-77-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download