darkcomet | 2b16710a962c2676143e1f663626bbd2b8daab3f70718414ce6d2cd534379b7b

Analysis

max time kernel
130s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Size

659KB
MD5

178db5992b083838ffb393f855bb3038
SHA1

113e849141da66115b181809169c4c590b5dcabb
SHA256

2b16710a962c2676143e1f663626bbd2b8daab3f70718414ce6d2cd534379b7b
SHA512

08e3e09cac0c6e9966f30119f6f94f95b4bd5f55d7e06e91b860e73e57e34648aa089af8168dce3eb1895e23604bf00adcad015a0fdf32994f7958e49afa1f5a
SSDEEP

12288:19AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKZ:zAQ6Zx9cxTmOrucTIEFSpOGU

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	explorer.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

explorer.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe
Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe
Disables RegEdit via registry modification 1 IoCs
evasion

Processes:

explorer.exe

description ioc process

Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe
Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts 178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	explorer.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

3576 notepad.exe

pid	process
3576	notepad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exenotepad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

description pid process target process

PID 3912 set thread context of 3772 3912 178db5992b083838ffb393f855bb3038_JaffaCakes118.exe explorer.exe

description	pid	process	target process
PID 3912 set thread context of 3772	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

3772 explorer.exe

pid	process
3772	explorer.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exeexplorer.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeSecurityPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeBackupPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeRestorePrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeShutdownPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeDebugPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeUndockPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: 33	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: 34	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: 35	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: 36	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3772	explorer.exe
Token: SeSecurityPrivilege	3772	explorer.exe
Token: SeTakeOwnershipPrivilege	3772	explorer.exe
Token: SeLoadDriverPrivilege	3772	explorer.exe
Token: SeSystemProfilePrivilege	3772	explorer.exe
Token: SeSystemtimePrivilege	3772	explorer.exe
Token: SeProfSingleProcessPrivilege	3772	explorer.exe
Token: SeIncBasePriorityPrivilege	3772	explorer.exe
Token: SeCreatePagefilePrivilege	3772	explorer.exe
Token: SeBackupPrivilege	3772	explorer.exe
Token: SeRestorePrivilege	3772	explorer.exe
Token: SeShutdownPrivilege	3772	explorer.exe
Token: SeDebugPrivilege	3772	explorer.exe
Token: SeSystemEnvironmentPrivilege	3772	explorer.exe
Token: SeChangeNotifyPrivilege	3772	explorer.exe
Token: SeRemoteShutdownPrivilege	3772	explorer.exe
Token: SeUndockPrivilege	3772	explorer.exe
Token: SeManageVolumePrivilege	3772	explorer.exe
Token: SeImpersonatePrivilege	3772	explorer.exe
Token: SeCreateGlobalPrivilege	3772	explorer.exe
Token: 33	3772	explorer.exe
Token: 34	3772	explorer.exe
Token: 35	3772	explorer.exe
Token: 36	3772	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

3772 explorer.exe

pid	process
3772	explorer.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

178db5992b083838ffb393f855bb3038_JaffaCakes118.exe

description	pid	process	target process
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 5052	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3772	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	explorer.exe
PID 3912 wrote to memory of 3772	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	explorer.exe
PID 3912 wrote to memory of 3772	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	explorer.exe
PID 3912 wrote to memory of 3772	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	explorer.exe
PID 3912 wrote to memory of 3772	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	explorer.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe
PID 3912 wrote to memory of 3576	3912	178db5992b083838ffb393f855bb3038_JaffaCakes118.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\178db5992b083838ffb393f855bb3038_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\178db5992b083838ffb393f855bb3038_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Adds Run key to start application
PID:5052

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3772

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
2⤵
- Deletes itself
PID:3576

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-8-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/3772-13-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-6-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-7-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-9-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-15-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-16-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/3772-12-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-14-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-10-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3772-18-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/3912-0-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/3912-11-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/5052-2-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download