darkcomet | 42ce6ab5574fbb9e287089c6b325a0e4f25b17a39dae4defc0d2bbb319b68941

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2025, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe
Size 1.1MB
Sample250201-swt6payjaz
SHA256 42ce6ab5574fbb9e287089c6b325a0e4f25b17a39dae4defc0d2bbb319b68941
MD5 73394bb1f3de631c5f0c845758c83ff4
SHA1 85a2eb61cb8ace750045ed2bdc36d83165e8abdd
SHA512 055b2adf104ba6f13fc609a837b1f613eb826ce48515e19677a9c00109384f3f0292d395450fd1d478023a813dce87c91fd09412ab7259340182e4e8c0908d8b
SSDEEP 24576:sy+uIkUtnyEEqleWB7qw9/2qMG5grBW94ZK++3Z3:bhqlb7+qMG5T94ZK++3Z3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet latentbot random defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Random

testinghost.zapto.org:6004

Mutex

DC_MUTEX-YY9LTKJ

Attributes

gencode
SqVNCTj5GpTx
install
false
offline_keylogger
true
persistence
false

Extracted

Family

latentbot

testinghost.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll.exe"	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3676 set thread context of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\rundll.exe:ZONE.identifier	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\rundll.exe:ZONE.identifier	cmd.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3580	vbc.exe
Token: SeSecurityPrivilege	3580	vbc.exe
Token: SeTakeOwnershipPrivilege	3580	vbc.exe
Token: SeLoadDriverPrivilege	3580	vbc.exe
Token: SeSystemProfilePrivilege	3580	vbc.exe
Token: SeSystemtimePrivilege	3580	vbc.exe
Token: SeProfSingleProcessPrivilege	3580	vbc.exe
Token: SeIncBasePriorityPrivilege	3580	vbc.exe
Token: SeCreatePagefilePrivilege	3580	vbc.exe
Token: SeBackupPrivilege	3580	vbc.exe
Token: SeRestorePrivilege	3580	vbc.exe
Token: SeShutdownPrivilege	3580	vbc.exe
Token: SeDebugPrivilege	3580	vbc.exe
Token: SeSystemEnvironmentPrivilege	3580	vbc.exe
Token: SeChangeNotifyPrivilege	3580	vbc.exe
Token: SeRemoteShutdownPrivilege	3580	vbc.exe
Token: SeUndockPrivilege	3580	vbc.exe
Token: SeManageVolumePrivilege	3580	vbc.exe
Token: SeImpersonatePrivilege	3580	vbc.exe
Token: SeCreateGlobalPrivilege	3580	vbc.exe
Token: 33	3580	vbc.exe
Token: 34	3580	vbc.exe
Token: 35	3580	vbc.exe
Token: 36	3580	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3580	vbc.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3580	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	86
PID 3676 wrote to memory of 3152	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	87
PID 3676 wrote to memory of 3152	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	87
PID 3676 wrote to memory of 3152	3676	JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe	87
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89
PID 3580 wrote to memory of 1988	3580	vbc.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73394bb1f3de631c5f0c845758c83ff4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rundll.exe:ZONE.identifier

Path C:\Users\Admin\AppData\Local\Temp\rundll.exe:ZONE.identifier
Size 27B
SHA256 f2b79cae559d6772afc1c2ed9468988178f8b6833d5028a15dea73ce47d0196e
MD5 130a75a932a2fe57bfea6a65b88da8f6
SHA1 b66d7530d150d45c0a390bb3c2cd4ca4fc404d1c
SHA512 6cd147c6f3af95803b7b0898e97ec2ed374c1f56a487b50e3d22003a67cec26a6fa12a3920b1b5624bde156f9601469ae3c7b7354fa8cf37be76c84121767eed
MD5 SHA1 SHA512

Submit Download

memory/1988-12-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download

memory/3580-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-3-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-7-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-8-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-13-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-19-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-29-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-25-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-27-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3580-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3676-0-0x0000000075162000-0x0000000075163000-memory.dmp

Download

memory/3676-16-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/3676-1-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/3676-2-0x0000000075160000-0x0000000075711000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads