darkcomet | b97ecb6f21b036150b573f4fb698203f466830476e861b78ebdfc3783237eed5

General

Target

d4bee2f5a634f3b857869f6f64ee0ad7_JaffaCakes118.exe
Size

403KB
MD5

d4bee2f5a634f3b857869f6f64ee0ad7
SHA1

2d4cda955bc6bbba8809603cb77b67f8f52f240d
SHA256

b97ecb6f21b036150b573f4fb698203f466830476e861b78ebdfc3783237eed5
SHA512

3348620d03d5d84c27c0df3fbbe0f7e9f273430b1cfff5141116fcaef94e33b40ff26f22421cb9172ca69d4a87d913be62b1057f5ba3712709ac51f991a49c61
SSDEEP

12288:ybxmzF9k0IZvQu85iGFoVs4ts/IHPCY35hh:ye3Lt5J2Xts/GqY3l

Score

10^/10

darkcomet discovery rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	prueva1.exe

Executes dropped EXE 2 IoCs

pid	Process
2116	BFile1.exe
2756	prueva1.exe

Loads dropped DLL 2 IoCs

pid	Process
2116	BFile1.exe
2116	BFile1.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000164de-18.dat	upx
behavioral1/memory/2756-28-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-31-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-32-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-33-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-34-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-35-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-36-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-37-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-38-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-39-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-40-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-41-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-42-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-43-0x0000000000400000-0x00000000004C5000-memory.dmp	upx
behavioral1/memory/2756-44-0x0000000000400000-0x00000000004C5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFile1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prueva1.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	prueva1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	prueva1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	prueva1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	prueva1.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	prueva1.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2756	prueva1.exe
Token: SeSecurityPrivilege	2756	prueva1.exe
Token: SeTakeOwnershipPrivilege	2756	prueva1.exe
Token: SeLoadDriverPrivilege	2756	prueva1.exe
Token: SeSystemProfilePrivilege	2756	prueva1.exe
Token: SeSystemtimePrivilege	2756	prueva1.exe
Token: SeProfSingleProcessPrivilege	2756	prueva1.exe
Token: SeIncBasePriorityPrivilege	2756	prueva1.exe
Token: SeCreatePagefilePrivilege	2756	prueva1.exe
Token: SeBackupPrivilege	2756	prueva1.exe
Token: SeRestorePrivilege	2756	prueva1.exe
Token: SeShutdownPrivilege	2756	prueva1.exe
Token: SeDebugPrivilege	2756	prueva1.exe
Token: SeSystemEnvironmentPrivilege	2756	prueva1.exe
Token: SeChangeNotifyPrivilege	2756	prueva1.exe
Token: SeRemoteShutdownPrivilege	2756	prueva1.exe
Token: SeUndockPrivilege	2756	prueva1.exe
Token: SeManageVolumePrivilege	2756	prueva1.exe
Token: SeImpersonatePrivilege	2756	prueva1.exe
Token: SeCreateGlobalPrivilege	2756	prueva1.exe
Token: 33	2756	prueva1.exe
Token: 34	2756	prueva1.exe
Token: 35	2756	prueva1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2116	BFile1.exe
2756	prueva1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2116	1736	d4bee2f5a634f3b857869f6f64ee0ad7_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2116	1736	d4bee2f5a634f3b857869f6f64ee0ad7_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2116	1736	d4bee2f5a634f3b857869f6f64ee0ad7_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2116	1736	d4bee2f5a634f3b857869f6f64ee0ad7_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2756	2116	BFile1.exe	32
PID 2116 wrote to memory of 2756	2116	BFile1.exe	32
PID 2116 wrote to memory of 2756	2116	BFile1.exe	32
PID 2116 wrote to memory of 2756	2116	BFile1.exe	32

C:\Users\Admin\AppData\Local\Temp\d4bee2f5a634f3b857869f6f64ee0ad7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4bee2f5a634f3b857869f6f64ee0ad7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\BFile1.exe
  "C:\Users\Admin\AppData\Local\Temp\BFile1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\prueva1.exe
    "C:\Users\Admin\AppData\Local\Temp\prueva1.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BFile1.exe

Filesize
334KB

MD5
949f418dd76c7f5c98d0c209dd6a964d

SHA1
556d8be36ee0d57e1cac38b9e23cc8a562675d56

SHA256
efc98996f752ca92540fba166b9c48a6498d8eeb9016cd4ff50bb20d45e0d113

SHA512
91e546db852267a63111fc4eadb624d3f846c9130391283669a5f2d274f4a951d6c63cbe33c4ccc0b5677700fba6167fe9896edf1735522f2418f6c5ae8a2efa

Download Submit
\Users\Admin\AppData\Local\Temp\prueva1.exe

Filesize
269KB

MD5
937d67e8fd1bddbba5a0f6689aaf0f39

SHA1
1f27be2496ea27dd85013425cfd0999fef2e990e

SHA256
f2946902dd17302bc30e764793c9f03b3157461f03501b16587a99d29589da4d

SHA512
d88677bb6bd7521487a41b10a9bbf44324a43cd75a89f336235583a5391fdf53d175ff944776a1cc0241b0f74bbf5bcb1acb51706e52dac9d635ef61fb5b2d3a

Download Submit
memory/1736-1-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/1736-2-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/1736-3-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/1736-16-0x000000001B140000-0x000000001B150000-memory.dmp

Filesize
64KB

Download
memory/1736-0-0x000007FEF5F1E000-0x000007FEF5F1F000-memory.dmp

Filesize
4KB

Download
memory/1736-29-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/2116-30-0x00000000028C0000-0x00000000028C2000-memory.dmp

Filesize
8KB

Download
memory/2116-26-0x0000000002EE0000-0x0000000002FA5000-memory.dmp

Filesize
788KB

Download
memory/2116-25-0x0000000002EE0000-0x0000000002FA5000-memory.dmp

Filesize
788KB

Download
memory/2756-31-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-37-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-32-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-33-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-34-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-35-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-36-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-28-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-38-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-39-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-40-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-41-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-42-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-43-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2756-44-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads