darkcomet | 63e6c1e082d5262282b2f35d92f966968f028c49b382215069fc7b48a93ef0d2

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe
Size

1.4MB
MD5

11bab9c459a906e6da57b894ffe9e274
SHA1

2dfeb032e948abaf96b178afdfdf6f04cbac332e
SHA256

63e6c1e082d5262282b2f35d92f966968f028c49b382215069fc7b48a93ef0d2
SHA512

3d68177d285a1c43e71ddfc73e6ff4aac7eda95d7e4de018d77a5b546250f5d1766759c2a63ae16d5b6b7cf82ad9ca5ad884228367aea6363df57baeaa1bc95f
SSDEEP

24576:N6FbugTnMmQtXspgr/5qMBclUEH3NXECRtxRD4f:2bumMmQtIgr/XcF9XhU

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

2796 vbc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe

description pid process target process

PID 3124 set thread context of 2796 3124 11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe vbc.exe

pid	process
2796	vbc.exe

description	pid	process	target process
PID 3124 set thread context of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2796	vbc.exe
Token: SeSecurityPrivilege	2796	vbc.exe
Token: SeTakeOwnershipPrivilege	2796	vbc.exe
Token: SeLoadDriverPrivilege	2796	vbc.exe
Token: SeSystemProfilePrivilege	2796	vbc.exe
Token: SeSystemtimePrivilege	2796	vbc.exe
Token: SeProfSingleProcessPrivilege	2796	vbc.exe
Token: SeIncBasePriorityPrivilege	2796	vbc.exe
Token: SeCreatePagefilePrivilege	2796	vbc.exe
Token: SeBackupPrivilege	2796	vbc.exe
Token: SeRestorePrivilege	2796	vbc.exe
Token: SeShutdownPrivilege	2796	vbc.exe
Token: SeDebugPrivilege	2796	vbc.exe
Token: SeSystemEnvironmentPrivilege	2796	vbc.exe
Token: SeChangeNotifyPrivilege	2796	vbc.exe
Token: SeRemoteShutdownPrivilege	2796	vbc.exe
Token: SeUndockPrivilege	2796	vbc.exe
Token: SeManageVolumePrivilege	2796	vbc.exe
Token: SeImpersonatePrivilege	2796	vbc.exe
Token: SeCreateGlobalPrivilege	2796	vbc.exe
Token: 33	2796	vbc.exe
Token: 34	2796	vbc.exe
Token: 35	2796	vbc.exe
Token: 36	2796	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe

description	pid	process	target process
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 2796	3124	11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11bab9c459a906e6da57b894ffe9e274_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3124

C:\Users\Admin\AppData\Local\Temp\vbc.exe
C:\Users\Admin\AppData\Local\Temp\vbc.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4608,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
1⤵
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vbc.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/2796-12-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2796-8-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2796-5-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2796-10-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2796-14-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2796-15-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2796-16-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2796-17-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2796-19-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3124-2-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download
memory/3124-13-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download
memory/3124-0-0x0000000074982000-0x0000000074983000-memory.dmp

Filesize
4KB

Download
memory/3124-1-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download