darkcomet | 58d1d43c864ff4a3926e02151ec48a9038586394ad3e3bb9193dc26e35718487

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Size

649KB
MD5

176ce8ced727581cc9f115c5aa55edea
SHA1

5f927c97f132d52defe29a7b8c54603187570d1c
SHA256

58d1d43c864ff4a3926e02151ec48a9038586394ad3e3bb9193dc26e35718487
SHA512

e0b3901ae184dfda7ebfa8903d2daa3076d96310d28407adfd2c8932b9c872e6e486c12daefe1e1d5568437d54198bcf13c8b7dd650d156c99cd1cc7547cc96b
SSDEEP

12288:Nk0QNlxOnizg37k4LUSd0rv5WvYW5HMzLXj9pqQd7cqESAYi991fA/aV7:+0QpGih4bd0rv5+l5szLXj917cqPu91L

Score

10^/10

darkcomet s3rv3r-2 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

s3rv3r-2

tengxunsafeupdate.servecounterstrike.com:82

Mutex

DCMIN_MUTEX-2NZCBWP

Attributes

InstallPath
WinDefender.exe
gencode
2mzxGWP6uod7
install
true
offline_keylogger
true
persistence
false
reg_key
WindowsDefender

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\WinDefender.exe"	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

WinDefender.exe

pid process

852 WinDefender.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe

pid	process
852	WinDefender.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\Documents\\WinDefender.exe"	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exeWinDefender.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeSecurityPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeBackupPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeRestorePrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeShutdownPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeDebugPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeUndockPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: 33	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: 34	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: 35	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: 36	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	852	WinDefender.exe
Token: SeSecurityPrivilege	852	WinDefender.exe
Token: SeTakeOwnershipPrivilege	852	WinDefender.exe
Token: SeLoadDriverPrivilege	852	WinDefender.exe
Token: SeSystemProfilePrivilege	852	WinDefender.exe
Token: SeSystemtimePrivilege	852	WinDefender.exe
Token: SeProfSingleProcessPrivilege	852	WinDefender.exe
Token: SeIncBasePriorityPrivilege	852	WinDefender.exe
Token: SeCreatePagefilePrivilege	852	WinDefender.exe
Token: SeBackupPrivilege	852	WinDefender.exe
Token: SeRestorePrivilege	852	WinDefender.exe
Token: SeShutdownPrivilege	852	WinDefender.exe
Token: SeDebugPrivilege	852	WinDefender.exe
Token: SeSystemEnvironmentPrivilege	852	WinDefender.exe
Token: SeChangeNotifyPrivilege	852	WinDefender.exe
Token: SeRemoteShutdownPrivilege	852	WinDefender.exe
Token: SeUndockPrivilege	852	WinDefender.exe
Token: SeManageVolumePrivilege	852	WinDefender.exe
Token: SeImpersonatePrivilege	852	WinDefender.exe
Token: SeCreateGlobalPrivilege	852	WinDefender.exe
Token: 33	852	WinDefender.exe
Token: 34	852	WinDefender.exe
Token: 35	852	WinDefender.exe
Token: 36	852	WinDefender.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinDefender.exe

pid process

852 WinDefender.exe

pid	process
852	WinDefender.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe

description	pid	process	target process
PID 1884 wrote to memory of 852	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe	WinDefender.exe
PID 1884 wrote to memory of 852	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe	WinDefender.exe
PID 1884 wrote to memory of 852	1884	176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe	WinDefender.exe

C:\Users\Admin\AppData\Local\Temp\176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\176ce8ced727581cc9f115c5aa55edea_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884

C:\Users\Admin\Documents\WinDefender.exe
"C:\Users\Admin\Documents\WinDefender.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\WinDefender.exe
Filesize
649KB

MD5
176ce8ced727581cc9f115c5aa55edea

SHA1
5f927c97f132d52defe29a7b8c54603187570d1c

SHA256
58d1d43c864ff4a3926e02151ec48a9038586394ad3e3bb9193dc26e35718487

SHA512
e0b3901ae184dfda7ebfa8903d2daa3076d96310d28407adfd2c8932b9c872e6e486c12daefe1e1d5568437d54198bcf13c8b7dd650d156c99cd1cc7547cc96b

Download Submit
memory/852-18-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-15-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-19-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-14-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-20-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-16-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-17-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-21-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-13-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/852-27-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-26-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-22-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-23-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-24-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/852-25-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1884-0-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1884-12-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download