darkcomet | 730ff1495bab72115609275b399bb180136c14193a03a273a48be7b09b00564e

General

Target

JaffaCakes118_f515591832abbf7effede841f62a3c07.exe
Size

757KB
MD5

f515591832abbf7effede841f62a3c07
SHA1

4af08860ad6d67410acdadaad8a41617ffc1fe03
SHA256

730ff1495bab72115609275b399bb180136c14193a03a273a48be7b09b00564e
SHA512

77e513c2b38b6de082f1663007a98c57706f5e391d68af2b91f9b4d7b38b72366b1272449117b6ffad99ec034e39c108f2706bfa812d46eb80b18cb5d73d7990
SSDEEP

12288:pANwRo+mv8QD4+0V16kzmvbrmNtzbMY7+XzYkIDRNE/mqdlHRGyzHnCzN3E0kRtr:pAT8QE+kmXe4iDsOqn8yGURtr

Score

10^/10

darkcomet discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Output.exe.exe	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe

Executes dropped EXE 2 IoCs

pid	Process
2684	Output.exe.exe
2132	Output.exe.exe

Loads dropped DLL 2 IoCs

pid	Process
3032	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe
3032	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 2132	2684	Output.exe.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\185988_396999113688303_871773645_n.jpg	DllHost.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\185988_396999113688303_871773645_n.jpg	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Output.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Output.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2132	Output.exe.exe
Token: SeSecurityPrivilege	2132	Output.exe.exe
Token: SeTakeOwnershipPrivilege	2132	Output.exe.exe
Token: SeLoadDriverPrivilege	2132	Output.exe.exe
Token: SeSystemProfilePrivilege	2132	Output.exe.exe
Token: SeSystemtimePrivilege	2132	Output.exe.exe
Token: SeProfSingleProcessPrivilege	2132	Output.exe.exe
Token: SeIncBasePriorityPrivilege	2132	Output.exe.exe
Token: SeCreatePagefilePrivilege	2132	Output.exe.exe
Token: SeBackupPrivilege	2132	Output.exe.exe
Token: SeRestorePrivilege	2132	Output.exe.exe
Token: SeShutdownPrivilege	2132	Output.exe.exe
Token: SeDebugPrivilege	2132	Output.exe.exe
Token: SeSystemEnvironmentPrivilege	2132	Output.exe.exe
Token: SeChangeNotifyPrivilege	2132	Output.exe.exe
Token: SeRemoteShutdownPrivilege	2132	Output.exe.exe
Token: SeUndockPrivilege	2132	Output.exe.exe
Token: SeManageVolumePrivilege	2132	Output.exe.exe
Token: SeImpersonatePrivilege	2132	Output.exe.exe
Token: SeCreateGlobalPrivilege	2132	Output.exe.exe
Token: 33	2132	Output.exe.exe
Token: 34	2132	Output.exe.exe
Token: 35	2132	Output.exe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1412	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1412	DllHost.exe
1412	DllHost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2684	3032	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe	30
PID 3032 wrote to memory of 2684	3032	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe	30
PID 3032 wrote to memory of 2684	3032	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe	30
PID 3032 wrote to memory of 2684	3032	JaffaCakes118_f515591832abbf7effede841f62a3c07.exe	30
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32
PID 2684 wrote to memory of 2132	2684	Output.exe.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f515591832abbf7effede841f62a3c07.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f515591832abbf7effede841f62a3c07.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Output.exe.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Output.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Output.exe.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Output.exe.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\185988_396999113688303_871773645_n.jpg

Filesize
43KB

MD5
28a59410ef6034d915abe8d88c3d78dd

SHA1
2993884d89ac0fe160077aa4e3108b95faf6206d

SHA256
5972768caf5f15a511c6f00f09370ec6b1764390a238e4ea039cae5d693079ba

SHA512
8b750f1940df00e6d7fe7fb8a496cc2121805851a022aa06f5e98f55f6870ad8b713ac7d9822b7ae87b7bda46e0b98fb4b1694785ae13fc1c66f0292a64dec0c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Output.exe.exe

Filesize
514KB

MD5
ef567dffb51368c57eb2bf3b358d849e

SHA1
91a71c967f8f337e3a36c90ef6b17cebd18b2222

SHA256
bf5c17820be4402ba89f5f4a737a3ae4297f4ffe9301f0996eda2fdf3149acc0

SHA512
f638e720a4d5affcb10bbe558bdbe2c01162f1127cf6e632e61b483bcdb40186cc14573f78b364fa57010d63cd975f62aa8082cbcea3a0c3ff9e3286aa9b879e

Download Submit
memory/1412-78-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1412-74-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1412-72-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2132-40-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-50-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-38-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-83-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2132-69-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-60-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-46-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-70-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-44-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-65-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-57-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-54-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-36-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-68-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-80-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-76-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2132-77-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2684-33-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2684-34-0x0000000000401000-0x00000000004E0000-memory.dmp

Filesize
892KB

Download
memory/2684-67-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/3032-71-0x00000000032E0000-0x00000000032E2000-memory.dmp

Filesize
8KB

Download
memory/3032-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3032-30-0x0000000003150000-0x0000000003254000-memory.dmp

Filesize
1.0MB

Download
memory/3032-31-0x0000000003150000-0x0000000003254000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing