darkcomet | 047b9549cc08b8749c2157d940bdfb737ea20a2bbf80089715f837b7041bea6d

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
Size

975KB
MD5

185cc9f3e3beacd8b0acb680fc70e8a4
SHA1

6cb610e875034fcedcc4ca666a2093947f8feb6a
SHA256

047b9549cc08b8749c2157d940bdfb737ea20a2bbf80089715f837b7041bea6d
SHA512

ada02977a7a7c97a0de040550c99cd54eb62d701c66709c44f689891981f4bde445614cf9eeab2ce2cef01d89e43c82e9dcd72370b3bcc36cbb17fa2da70a490
SSDEEP

12288:ngn5H64rtuq9uHUVsz+peuncYLXjsyBOjxcK1NcCjk+I7lGbl0sDgP3ngbr3aHi2:86MtuGuepHcYLzGjvcCjRI74gIryi

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

WinUdapter.exe

pid process

3576 WinUdapter.exe

pid	process
3576	WinUdapter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinZip = "C:\\Users\\Admin\\AppData\\Roaming\\leftoverdccrypt.exe"	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe

description pid process target process

PID 4516 set thread context of 3576 4516 185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe WinUdapter.exe

description	pid	process	target process
PID 4516 set thread context of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

WinUdapter.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3576	WinUdapter.exe
Token: SeSecurityPrivilege	3576	WinUdapter.exe
Token: SeTakeOwnershipPrivilege	3576	WinUdapter.exe
Token: SeLoadDriverPrivilege	3576	WinUdapter.exe
Token: SeSystemProfilePrivilege	3576	WinUdapter.exe
Token: SeSystemtimePrivilege	3576	WinUdapter.exe
Token: SeProfSingleProcessPrivilege	3576	WinUdapter.exe
Token: SeIncBasePriorityPrivilege	3576	WinUdapter.exe
Token: SeCreatePagefilePrivilege	3576	WinUdapter.exe
Token: SeBackupPrivilege	3576	WinUdapter.exe
Token: SeRestorePrivilege	3576	WinUdapter.exe
Token: SeShutdownPrivilege	3576	WinUdapter.exe
Token: SeDebugPrivilege	3576	WinUdapter.exe
Token: SeSystemEnvironmentPrivilege	3576	WinUdapter.exe
Token: SeChangeNotifyPrivilege	3576	WinUdapter.exe
Token: SeRemoteShutdownPrivilege	3576	WinUdapter.exe
Token: SeUndockPrivilege	3576	WinUdapter.exe
Token: SeManageVolumePrivilege	3576	WinUdapter.exe
Token: SeImpersonatePrivilege	3576	WinUdapter.exe
Token: SeCreateGlobalPrivilege	3576	WinUdapter.exe
Token: 33	3576	WinUdapter.exe
Token: 34	3576	WinUdapter.exe
Token: 35	3576	WinUdapter.exe
Token: 36	3576	WinUdapter.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinUdapter.exe

pid process

3576 WinUdapter.exe

pid	process
3576	WinUdapter.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe

description	pid	process	target process
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe
PID 4516 wrote to memory of 3576	4516	185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe	WinUdapter.exe

C:\Users\Admin\AppData\Local\Temp\185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\185cc9f3e3beacd8b0acb680fc70e8a4_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4516

C:\Users\Admin\AppData\Roaming\WinUdapter.exe
C:\Users\Admin\AppData\Roaming\WinUdapter.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinUdapter.exe
Filesize
1KB

MD5
7c32886c3cd06d6036c0462301ad289c

SHA1
a0a54552a7ecf7082bac0af6c5bca610225b05df

SHA256
72c341969754f9e11b85119ca8db22eba2f4a6173c6bac14a032360073799009

SHA512
08613b8dc53125c6ff051a98989eb9c4eb447ad05243db1b956ae2969e8463c2a216ed6873274d5b3e890307ad219d761324aa702b3ee45f776b80336147d523

Download Submit
memory/3576-15-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3576-11-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-19-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-9-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-20-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-13-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-32-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-21-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-18-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-17-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-16-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-31-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-6-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-29-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-28-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-22-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-23-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-24-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-25-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-26-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3576-27-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/4516-1-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/4516-2-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/4516-0-0x0000000074932000-0x0000000074933000-memory.dmp

Filesize
4KB

Download
memory/4516-14-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download