darkcomet | b620ac56c00c30c80c963f45ce7f091a12d0bb36389e776b67cfb1bc0e17cb5b

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe
Size

687KB
MD5

a24a0e786c1e0673b83ed4fff9eba166
SHA1

361384a502ddcd27b329e8c39eac7d9753db42f4
SHA256

b620ac56c00c30c80c963f45ce7f091a12d0bb36389e776b67cfb1bc0e17cb5b
SHA512

d3a6b3ebf9a5bdd4cba708fe5c926b6c9cb5900768a36791a5d99113119c6937bfb8499f55af4c07f1c1084288284692cb0d4e3113551a23dbbdb9fe6bdec71d
SSDEEP

12288:PDbJhI6jsJlxaBYVjLjo5rD8yjSfDp4Adnbg5kUx:P5y++lbKrDsfDhbg5kUx

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

merio.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windowsdir\\rescure\\winsecure.exe"	merio.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

merio.exewinsecure.exeexplorer.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	merio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winsecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Executes dropped EXE 2 IoCs

Processes:

merio.exewinsecure.exe

pid	Process
584	merio.exe
2828	winsecure.exe

Loads dropped DLL 4 IoCs

Processes:

a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exemerio.exe

pid	Process
3016	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe
3016	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe
584	merio.exe
584	merio.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

merio.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\windir = "C:\\Windowsdir\\rescure\\winsecure.exe"	merio.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winsecure.exe

description	pid	Process	procid_target
PID 2828 set thread context of 2184	2828	winsecure.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

merio.exewinsecure.exeexplorer.exea24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	merio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsecure.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

merio.exewinsecure.exeexplorer.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	merio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winsecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winsecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	merio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	merio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	merio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winsecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winsecure.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exemerio.exewinsecure.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	merio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winsecure.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

merio.exewinsecure.exeexplorer.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	584	merio.exe
Token: SeSecurityPrivilege	584	merio.exe
Token: SeTakeOwnershipPrivilege	584	merio.exe
Token: SeLoadDriverPrivilege	584	merio.exe
Token: SeSystemProfilePrivilege	584	merio.exe
Token: SeSystemtimePrivilege	584	merio.exe
Token: SeProfSingleProcessPrivilege	584	merio.exe
Token: SeIncBasePriorityPrivilege	584	merio.exe
Token: SeCreatePagefilePrivilege	584	merio.exe
Token: SeBackupPrivilege	584	merio.exe
Token: SeRestorePrivilege	584	merio.exe
Token: SeShutdownPrivilege	584	merio.exe
Token: SeDebugPrivilege	584	merio.exe
Token: SeSystemEnvironmentPrivilege	584	merio.exe
Token: SeChangeNotifyPrivilege	584	merio.exe
Token: SeRemoteShutdownPrivilege	584	merio.exe
Token: SeUndockPrivilege	584	merio.exe
Token: SeManageVolumePrivilege	584	merio.exe
Token: SeImpersonatePrivilege	584	merio.exe
Token: SeCreateGlobalPrivilege	584	merio.exe
Token: 33	584	merio.exe
Token: 34	584	merio.exe
Token: 35	584	merio.exe
Token: SeIncreaseQuotaPrivilege	2828	winsecure.exe
Token: SeSecurityPrivilege	2828	winsecure.exe
Token: SeTakeOwnershipPrivilege	2828	winsecure.exe
Token: SeLoadDriverPrivilege	2828	winsecure.exe
Token: SeSystemProfilePrivilege	2828	winsecure.exe
Token: SeSystemtimePrivilege	2828	winsecure.exe
Token: SeProfSingleProcessPrivilege	2828	winsecure.exe
Token: SeIncBasePriorityPrivilege	2828	winsecure.exe
Token: SeCreatePagefilePrivilege	2828	winsecure.exe
Token: SeBackupPrivilege	2828	winsecure.exe
Token: SeRestorePrivilege	2828	winsecure.exe
Token: SeShutdownPrivilege	2828	winsecure.exe
Token: SeDebugPrivilege	2828	winsecure.exe
Token: SeSystemEnvironmentPrivilege	2828	winsecure.exe
Token: SeChangeNotifyPrivilege	2828	winsecure.exe
Token: SeRemoteShutdownPrivilege	2828	winsecure.exe
Token: SeUndockPrivilege	2828	winsecure.exe
Token: SeManageVolumePrivilege	2828	winsecure.exe
Token: SeImpersonatePrivilege	2828	winsecure.exe
Token: SeCreateGlobalPrivilege	2828	winsecure.exe
Token: 33	2828	winsecure.exe
Token: 34	2828	winsecure.exe
Token: 35	2828	winsecure.exe
Token: SeIncreaseQuotaPrivilege	2184	explorer.exe
Token: SeSecurityPrivilege	2184	explorer.exe
Token: SeTakeOwnershipPrivilege	2184	explorer.exe
Token: SeLoadDriverPrivilege	2184	explorer.exe
Token: SeSystemProfilePrivilege	2184	explorer.exe
Token: SeSystemtimePrivilege	2184	explorer.exe
Token: SeProfSingleProcessPrivilege	2184	explorer.exe
Token: SeIncBasePriorityPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeBackupPrivilege	2184	explorer.exe
Token: SeRestorePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeDebugPrivilege	2184	explorer.exe
Token: SeSystemEnvironmentPrivilege	2184	explorer.exe
Token: SeChangeNotifyPrivilege	2184	explorer.exe
Token: SeRemoteShutdownPrivilege	2184	explorer.exe
Token: SeUndockPrivilege	2184	explorer.exe
Token: SeManageVolumePrivilege	2184	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exeexplorer.exe

pid	Process
3016	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe
2184	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exemerio.exewinsecure.exe

description	pid	Process	procid_target
PID 3016 wrote to memory of 584	3016	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe	31
PID 3016 wrote to memory of 584	3016	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe	31
PID 3016 wrote to memory of 584	3016	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe	31
PID 3016 wrote to memory of 584	3016	a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe	31
PID 584 wrote to memory of 2780	584	merio.exe	32
PID 584 wrote to memory of 2780	584	merio.exe	32
PID 584 wrote to memory of 2780	584	merio.exe	32
PID 584 wrote to memory of 2780	584	merio.exe	32
PID 584 wrote to memory of 2828	584	merio.exe	33
PID 584 wrote to memory of 2828	584	merio.exe	33
PID 584 wrote to memory of 2828	584	merio.exe	33
PID 584 wrote to memory of 2828	584	merio.exe	33
PID 2828 wrote to memory of 2184	2828	winsecure.exe	34
PID 2828 wrote to memory of 2184	2828	winsecure.exe	34
PID 2828 wrote to memory of 2184	2828	winsecure.exe	34
PID 2828 wrote to memory of 2184	2828	winsecure.exe	34
PID 2828 wrote to memory of 2184	2828	winsecure.exe	34
PID 2828 wrote to memory of 2184	2828	winsecure.exe	34

C:\Users\Admin\AppData\Local\Temp\a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a24a0e786c1e0673b83ed4fff9eba166_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\merio.exe
  C:\Users\Admin\AppData\Local\Temp\merio.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:2780
- - C:\Windowsdir\rescure\winsecure.exe
    "C:\Windowsdir\rescure\winsecure.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      Checks BIOS information in registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\merio.exe

Filesize
667KB

MD5
26e474637214ea785a7b78a380ceddae

SHA1
89bd02e6ea68df13c3cf82183f13c44d317e0b6e

SHA256
1285efaaaaa438756a2c0d9ca5fc6927c35706761476826b52e4adc821d7312e

SHA512
ef7fd940d86754bc1fe629d08017c8a503f4c7233d3c693d0addf1af71eb52aa43d61909da0b7900dada2477e2bcd131ef40832e2261177e3d77b222e8c2dd4e

Download Submit
memory/584-10-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/584-22-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2184-27-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-25-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-29-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-30-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-33-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-32-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-31-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-34-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2828-28-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download