darkcomet | 031c039ee37731d1993e68127833a1a339f28540ddd6110b3ecd82e7bbf88715

General

Target

JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
Size

613KB
MD5

0c09e3b7a2d9fbe91815c43651fc4f66
SHA1

71fe5650a32fa20503d32dfea9f271e6ee37bb04
SHA256

031c039ee37731d1993e68127833a1a339f28540ddd6110b3ecd82e7bbf88715
SHA512

1ac88f66eb589914a1855b83e4b448dfe57db5c98461c16311224a579f1d8060ce9bd33b1dd940a36f4f486b5e2271c5a8a118bcc1cab9a73d97f50f1dc6b89b
SSDEEP

6144:jcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37qP4xUQddMYnZb0ZIvLBDLw/W8s:jcW7KEZlPzCy37qQxPdVZJjBbxePxez

Score

10^/10

darkcomet latentbot darkrat discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Darkrat

C2

portforward.zapto.org:1604

Mutex

DC_MUTEX-G4WGKMK

Attributes

gencode
qkNCjqMct6Kb
install
false
offline_keylogger
true
persistence
false

rc4.plain

Extracted

Family

latentbot

C2

portforward.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Executes dropped EXE 2 IoCs

pid	Process
2168	File1.exe
1192	File2.exe

Loads dropped DLL 3 IoCs

pid	Process
2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000016458-5.dat	upx
behavioral1/memory/2168-14-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-26-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-27-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-29-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-30-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-31-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-32-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-33-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-34-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-35-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-36-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-37-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-38-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-39-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-40-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/memory/2168-41-0x0000000000400000-0x00000000004C6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	File1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	File2.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2168	File1.exe
Token: SeSecurityPrivilege	2168	File1.exe
Token: SeTakeOwnershipPrivilege	2168	File1.exe
Token: SeLoadDriverPrivilege	2168	File1.exe
Token: SeSystemProfilePrivilege	2168	File1.exe
Token: SeSystemtimePrivilege	2168	File1.exe
Token: SeProfSingleProcessPrivilege	2168	File1.exe
Token: SeIncBasePriorityPrivilege	2168	File1.exe
Token: SeCreatePagefilePrivilege	2168	File1.exe
Token: SeBackupPrivilege	2168	File1.exe
Token: SeRestorePrivilege	2168	File1.exe
Token: SeShutdownPrivilege	2168	File1.exe
Token: SeDebugPrivilege	2168	File1.exe
Token: SeSystemEnvironmentPrivilege	2168	File1.exe
Token: SeChangeNotifyPrivilege	2168	File1.exe
Token: SeRemoteShutdownPrivilege	2168	File1.exe
Token: SeUndockPrivilege	2168	File1.exe
Token: SeManageVolumePrivilege	2168	File1.exe
Token: SeImpersonatePrivilege	2168	File1.exe
Token: SeCreateGlobalPrivilege	2168	File1.exe
Token: 33	2168	File1.exe
Token: 34	2168	File1.exe
Token: 35	2168	File1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2168	File1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	29
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	29
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	29
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	29
PID 2608 wrote to memory of 1192	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	30
PID 2608 wrote to memory of 1192	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	30
PID 2608 wrote to memory of 1192	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	30
PID 2608 wrote to memory of 1192	2608	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\File1.exe
  C:\Users\Admin\AppData\Local\Temp\File1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\File2.exe
  C:\Users\Admin\AppData\Local\Temp\File2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\File1.exe

Filesize
283KB

MD5
f6958a4893f184559d9f05577f2370e8

SHA1
12e9fec743d2fcf6b84fe0acbfbcbd886705dd6b

SHA256
43b6c44a1ff3ea537aea7b776ecc523fd8b2e937ab13d9a8deae9e2a2081a625

SHA512
0ad56450d3c47369b13b8ac213c8d9636c6f361f29748772c32b63af29be9c5aaac6641a6a4cd1d0b1c6a68b20b669df7566893be1c80d0069a64baa2536d6d5

Download Submit
\Users\Admin\AppData\Local\Temp\File2.exe

Filesize
300KB

MD5
b203d813c91e2e17498ec9855308349f

SHA1
7804ced99014cbefda00dd6f205e68da42a4219c

SHA256
200b493427d0f311c073ea54c50351d6fd043b5939d7d2ff5bd9a55796d78680

SHA512
9aa28006c379a6c433f4a0c9f2a8b91936cbe76c2e556e680be86633215c5f4879bed550b1c2c0037b4799df3b1667f51c069c87e91bd565a86405b38970de6b

Download Submit
memory/1192-28-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/1192-23-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/1192-22-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/1192-21-0x000007FEF5D9E000-0x000007FEF5D9F000-memory.dmp

Filesize
4KB

Download
memory/2168-26-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-34-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-41-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-14-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-40-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-39-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-38-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-37-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-36-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-27-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-35-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-29-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-30-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-31-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-32-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-33-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2168-15-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2608-1-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-0-0x00000000745B1000-0x00000000745B2000-memory.dmp

Filesize
4KB

Download
memory/2608-25-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-2-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-24-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-11-0x0000000004930000-0x00000000049F6000-memory.dmp

Filesize
792KB

Download
memory/2608-12-0x0000000004930000-0x00000000049F6000-memory.dmp

Filesize
792KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads