darkcomet | ce69635f8262ee0482e2b5f06dd66f496c05c06543630f25ce530cc5ad801ac9

General

Target

JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe
Size

721KB
MD5

09f4e2ced742f8913a77ffa311eaf740
SHA1

4fab38c7afb2ff41b9602439be100881aa5d799d
SHA256

ce69635f8262ee0482e2b5f06dd66f496c05c06543630f25ce530cc5ad801ac9
SHA512

ebc576ddd40159e31d659be78c818f0338d640760290dbd183b7fb9dd6110f5b0201c81024d464d6c11999db06eff6a6a12226aa08e7f6cb32c823b9b0ba41c6
SSDEEP

12288:TCMbgChxy1pcyyTVBOLUYrCBXNWAj9TVD1CQ6LfifMTqu3vRzM3IqOpMlGz+Hd:ThbJfxMrCBw5zdqOpGGz+H

Score

10^/10

darkcomet rudeking discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

RudeKing

C2

dofusrude.no-ip.biz:35

Mutex

DC_MUTEX-4M0YDTW

Attributes

gencode
X6c9wzwdMgVQ
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 884 set thread context of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe
Token: SeIncreaseQuotaPrivilege	4500	cvtres.exe
Token: SeSecurityPrivilege	4500	cvtres.exe
Token: SeTakeOwnershipPrivilege	4500	cvtres.exe
Token: SeLoadDriverPrivilege	4500	cvtres.exe
Token: SeSystemProfilePrivilege	4500	cvtres.exe
Token: SeSystemtimePrivilege	4500	cvtres.exe
Token: SeProfSingleProcessPrivilege	4500	cvtres.exe
Token: SeIncBasePriorityPrivilege	4500	cvtres.exe
Token: SeCreatePagefilePrivilege	4500	cvtres.exe
Token: SeBackupPrivilege	4500	cvtres.exe
Token: SeRestorePrivilege	4500	cvtres.exe
Token: SeShutdownPrivilege	4500	cvtres.exe
Token: SeDebugPrivilege	4500	cvtres.exe
Token: SeSystemEnvironmentPrivilege	4500	cvtres.exe
Token: SeChangeNotifyPrivilege	4500	cvtres.exe
Token: SeRemoteShutdownPrivilege	4500	cvtres.exe
Token: SeUndockPrivilege	4500	cvtres.exe
Token: SeManageVolumePrivilege	4500	cvtres.exe
Token: SeImpersonatePrivilege	4500	cvtres.exe
Token: SeCreateGlobalPrivilege	4500	cvtres.exe
Token: 33	4500	cvtres.exe
Token: 34	4500	cvtres.exe
Token: 35	4500	cvtres.exe
Token: 36	4500	cvtres.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	cvtres.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 440	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	86
PID 884 wrote to memory of 440	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	86
PID 884 wrote to memory of 440	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	86
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87
PID 884 wrote to memory of 4500	884	JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f4e2ced742f8913a77ffa311eaf740.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:440
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cc.vbs

Filesize
367B

MD5
c7635d80d806eb51bfcdc2cb95604c6b

SHA1
85e18cac101afc075be3918fe140058f6448df75

SHA256
01f1ce00f14a8a03e675318a98044cbbb73dff20a2312c1cd6d2276efd938055

SHA512
4d015ed9436d8946679b444880bc434ba23a95d07f45443176037bf08294a5425235434a7f5c7f673de5d7db6fe32e60000f372a3f011653aeb57ff3180db33d

Download Submit
memory/884-16-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/884-1-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/884-2-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/884-0-0x0000000074962000-0x0000000074963000-memory.dmp

Filesize
4KB

Download
memory/4500-19-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-12-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-9-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-15-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-13-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-8-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-25-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-27-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-29-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4500-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing