darkcomet | 031c039ee37731d1993e68127833a1a339f28540ddd6110b3ecd82e7bbf88715

General

Target

JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
Size

613KB
MD5

0c09e3b7a2d9fbe91815c43651fc4f66
SHA1

71fe5650a32fa20503d32dfea9f271e6ee37bb04
SHA256

031c039ee37731d1993e68127833a1a339f28540ddd6110b3ecd82e7bbf88715
SHA512

1ac88f66eb589914a1855b83e4b448dfe57db5c98461c16311224a579f1d8060ce9bd33b1dd940a36f4f486b5e2271c5a8a118bcc1cab9a73d97f50f1dc6b89b
SSDEEP

6144:jcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37qP4xUQddMYnZb0ZIvLBDLw/W8s:jcW7KEZlPzCy37qQxPdVZJjBbxePxez

Score

10^/10

darkcomet latentbot darkrat discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Darkrat

C2

portforward.zapto.org:1604

Mutex

DC_MUTEX-G4WGKMK

Attributes

gencode
qkNCjqMct6Kb
install
false
offline_keylogger
true
persistence
false

rc4.plain

Extracted

Family

latentbot

C2

portforward.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Executes dropped EXE 2 IoCs

pid	Process
928	File1.exe
1960	File2.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001da46-6.dat	upx
behavioral2/memory/928-7-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-25-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-28-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-29-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-30-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-31-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-32-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-33-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-34-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-35-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-36-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-37-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-38-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-39-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-40-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/928-41-0x0000000000400000-0x00000000004C6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	File1.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	928	File1.exe
Token: SeSecurityPrivilege	928	File1.exe
Token: SeTakeOwnershipPrivilege	928	File1.exe
Token: SeLoadDriverPrivilege	928	File1.exe
Token: SeSystemProfilePrivilege	928	File1.exe
Token: SeSystemtimePrivilege	928	File1.exe
Token: SeProfSingleProcessPrivilege	928	File1.exe
Token: SeIncBasePriorityPrivilege	928	File1.exe
Token: SeCreatePagefilePrivilege	928	File1.exe
Token: SeBackupPrivilege	928	File1.exe
Token: SeRestorePrivilege	928	File1.exe
Token: SeShutdownPrivilege	928	File1.exe
Token: SeDebugPrivilege	928	File1.exe
Token: SeSystemEnvironmentPrivilege	928	File1.exe
Token: SeChangeNotifyPrivilege	928	File1.exe
Token: SeRemoteShutdownPrivilege	928	File1.exe
Token: SeUndockPrivilege	928	File1.exe
Token: SeManageVolumePrivilege	928	File1.exe
Token: SeImpersonatePrivilege	928	File1.exe
Token: SeCreateGlobalPrivilege	928	File1.exe
Token: 33	928	File1.exe
Token: 34	928	File1.exe
Token: 35	928	File1.exe
Token: 36	928	File1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
928	File1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 928	4944	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	86
PID 4944 wrote to memory of 928	4944	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	86
PID 4944 wrote to memory of 928	4944	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	86
PID 4944 wrote to memory of 1960	4944	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	87
PID 4944 wrote to memory of 1960	4944	JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\File1.exe
  C:\Users\Admin\AppData\Local\Temp\File1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:928
- C:\Users\Admin\AppData\Local\Temp\File2.exe
  C:\Users\Admin\AppData\Local\Temp\File2.exe
  2⤵
  - Executes dropped EXE
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\File1.exe

Filesize
283KB

MD5
f6958a4893f184559d9f05577f2370e8

SHA1
12e9fec743d2fcf6b84fe0acbfbcbd886705dd6b

SHA256
43b6c44a1ff3ea537aea7b776ecc523fd8b2e937ab13d9a8deae9e2a2081a625

SHA512
0ad56450d3c47369b13b8ac213c8d9636c6f361f29748772c32b63af29be9c5aaac6641a6a4cd1d0b1c6a68b20b669df7566893be1c80d0069a64baa2536d6d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\File2.exe

Filesize
300KB

MD5
b203d813c91e2e17498ec9855308349f

SHA1
7804ced99014cbefda00dd6f205e68da42a4219c

SHA256
200b493427d0f311c073ea54c50351d6fd043b5939d7d2ff5bd9a55796d78680

SHA512
9aa28006c379a6c433f4a0c9f2a8b91936cbe76c2e556e680be86633215c5f4879bed550b1c2c0037b4799df3b1667f51c069c87e91bd565a86405b38970de6b

Download Submit
memory/928-38-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-35-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-7-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-9-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/928-41-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-39-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-28-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-37-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-36-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-40-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-34-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-33-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-32-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-31-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-30-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-29-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/928-25-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1960-14-0x000000001BCD0000-0x000000001BD76000-memory.dmp

Filesize
664KB

Download
memory/1960-17-0x00007FF8B27B0000-0x00007FF8B3151000-memory.dmp

Filesize
9.6MB

Download
memory/1960-26-0x00007FF8B2A65000-0x00007FF8B2A66000-memory.dmp

Filesize
4KB

Download
memory/1960-24-0x00007FF8B27B0000-0x00007FF8B3151000-memory.dmp

Filesize
9.6MB

Download
memory/1960-13-0x00007FF8B2A65000-0x00007FF8B2A66000-memory.dmp

Filesize
4KB

Download
memory/1960-22-0x00007FF8B27B0000-0x00007FF8B3151000-memory.dmp

Filesize
9.6MB

Download
memory/1960-19-0x000000001BC70000-0x000000001BC78000-memory.dmp

Filesize
32KB

Download
memory/1960-20-0x000000001C9A0000-0x000000001C9EC000-memory.dmp

Filesize
304KB

Download
memory/1960-18-0x000000001C840000-0x000000001C8DC000-memory.dmp

Filesize
624KB

Download
memory/1960-16-0x000000001C250000-0x000000001C71E000-memory.dmp

Filesize
4.8MB

Download
memory/1960-27-0x00007FF8B27B0000-0x00007FF8B3151000-memory.dmp

Filesize
9.6MB

Download
memory/1960-15-0x00007FF8B27B0000-0x00007FF8B3151000-memory.dmp

Filesize
9.6MB

Download
memory/4944-0-0x0000000075222000-0x0000000075223000-memory.dmp

Filesize
4KB

Download
memory/4944-23-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download
memory/4944-2-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download
memory/4944-1-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads