darkcomet | 3a067942f8e86aa1267b8bad398dc683aa189082cc86964ac93116f4fca089e1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe
Size

1.0MB
MD5

174f6ff5bdb4c4bbd35534e61147866f
SHA1

0d191afc84cd1cedf74fe6b7eefedafeabf6fa9c
SHA256

3a067942f8e86aa1267b8bad398dc683aa189082cc86964ac93116f4fca089e1
SHA512

a062ef8d98ea052c1e0019d50980211770ff76e74f6a8ac3903236c254bdd1f604bd9f824812bd08275c112c4ca0b4cb2b8996704e3177ceb3d8112e057af345
SSDEEP

24576:09yzZQBIrvzTevzSCvS/Lq+uGGGCCUAx2l:09CQarvznCvS/LkGXCPAO

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

3288 vbc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe

description pid process target process

PID 4960 set thread context of 3288 4960 174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe vbc.exe

pid	process
3288	vbc.exe

description	pid	process	target process
PID 4960 set thread context of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3288	vbc.exe
Token: SeSecurityPrivilege	3288	vbc.exe
Token: SeTakeOwnershipPrivilege	3288	vbc.exe
Token: SeLoadDriverPrivilege	3288	vbc.exe
Token: SeSystemProfilePrivilege	3288	vbc.exe
Token: SeSystemtimePrivilege	3288	vbc.exe
Token: SeProfSingleProcessPrivilege	3288	vbc.exe
Token: SeIncBasePriorityPrivilege	3288	vbc.exe
Token: SeCreatePagefilePrivilege	3288	vbc.exe
Token: SeBackupPrivilege	3288	vbc.exe
Token: SeRestorePrivilege	3288	vbc.exe
Token: SeShutdownPrivilege	3288	vbc.exe
Token: SeDebugPrivilege	3288	vbc.exe
Token: SeSystemEnvironmentPrivilege	3288	vbc.exe
Token: SeChangeNotifyPrivilege	3288	vbc.exe
Token: SeRemoteShutdownPrivilege	3288	vbc.exe
Token: SeUndockPrivilege	3288	vbc.exe
Token: SeManageVolumePrivilege	3288	vbc.exe
Token: SeImpersonatePrivilege	3288	vbc.exe
Token: SeCreateGlobalPrivilege	3288	vbc.exe
Token: 33	3288	vbc.exe
Token: 34	3288	vbc.exe
Token: 35	3288	vbc.exe
Token: 36	3288	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

3288 vbc.exe

pid	process
3288	vbc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe

description	pid	process	target process
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe
PID 4960 wrote to memory of 3288	4960	174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\174f6ff5bdb4c4bbd35534e61147866f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4960

C:\Users\Admin\AppData\Local\Temp\vbc.exe
C:\Users\Admin\AppData\Local\Temp\vbc.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3288

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vbc.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/3288-17-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-27-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-6-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-10-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-8-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-11-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-14-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-29-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-3-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-20-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-19-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-22-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-23-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-24-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-25-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-26-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-16-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3288-28-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4960-0-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

Filesize
2.0MB

Download