darkcomet | 16181fddc28a16679199e91d57fec4ee7ecf2a8ab478783667960c69c446d410

Analysis

max time kernel
148s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Size

448KB
MD5

f0b8852c0b559264764e4b682e1c1117
SHA1

13182e5f1c700f246d452d702a6b3d49417fbf53
SHA256

16181fddc28a16679199e91d57fec4ee7ecf2a8ab478783667960c69c446d410
SHA512

7afc8b2509e61a623b4369e4b4d7c683945b3537bf661ac1480297e5147d445d7daee7200b9b0dadaa5cb766335c680bb3f2989d1b8edf9e6a3a8742571d4ca6
SSDEEP

12288:NP4KfCRm47i/2Yku5upF1R36NaQ4ppnJN9IJaeh:VGHYkuspPRUQmJaO

Score

10^/10

darkcomet guest16 discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-1DN0ZPY

Attributes

gencode
pnkjqJ5i6PP5
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 1776	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe	82

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1848-0-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/1776-2-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/1848-4-0x0000000000400000-0x0000000000519000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeSecurityPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeTakeOwnershipPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeLoadDriverPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeSystemProfilePrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeSystemtimePrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeProfSingleProcessPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeIncBasePriorityPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeCreatePagefilePrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeBackupPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeRestorePrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeShutdownPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeDebugPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeSystemEnvironmentPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeChangeNotifyPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeRemoteShutdownPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeUndockPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeManageVolumePrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeImpersonatePrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeCreateGlobalPrivilege	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: 33	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: 34	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: 35	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: 36	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Token: SeIncreaseQuotaPrivilege	1776	iexplore.exe
Token: SeSecurityPrivilege	1776	iexplore.exe
Token: SeTakeOwnershipPrivilege	1776	iexplore.exe
Token: SeLoadDriverPrivilege	1776	iexplore.exe
Token: SeSystemProfilePrivilege	1776	iexplore.exe
Token: SeSystemtimePrivilege	1776	iexplore.exe
Token: SeProfSingleProcessPrivilege	1776	iexplore.exe
Token: SeIncBasePriorityPrivilege	1776	iexplore.exe
Token: SeCreatePagefilePrivilege	1776	iexplore.exe
Token: SeBackupPrivilege	1776	iexplore.exe
Token: SeRestorePrivilege	1776	iexplore.exe
Token: SeShutdownPrivilege	1776	iexplore.exe
Token: SeDebugPrivilege	1776	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1776	iexplore.exe
Token: SeChangeNotifyPrivilege	1776	iexplore.exe
Token: SeRemoteShutdownPrivilege	1776	iexplore.exe
Token: SeUndockPrivilege	1776	iexplore.exe
Token: SeManageVolumePrivilege	1776	iexplore.exe
Token: SeImpersonatePrivilege	1776	iexplore.exe
Token: SeCreateGlobalPrivilege	1776	iexplore.exe
Token: 33	1776	iexplore.exe
Token: 34	1776	iexplore.exe
Token: 35	1776	iexplore.exe
Token: 36	1776	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1776	iexplore.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1776	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe	82
PID 1848 wrote to memory of 1776	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe	82
PID 1848 wrote to memory of 1776	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe	82
PID 1848 wrote to memory of 1776	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe	82
PID 1848 wrote to memory of 1776	1848	JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-2-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1848-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1848-1-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1848-4-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download