darkcomet | 1c244b40232d1e87125fa5083e79b7560bb35c6f421b1128180f0906ded3770b

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Size

511KB
MD5

1b60b154aecd6b63d917dab4ed154850
SHA1

71d318fa123030652a36791da942027e7859c05f
SHA256

1c244b40232d1e87125fa5083e79b7560bb35c6f421b1128180f0906ded3770b
SHA512

a969b8320ffdaa80be0434bbeda4adc08936b23caca552f9298433fadee412216e3db641b0ae3fbdc32dc5bec51bb63ecdd153a1134cdb45a5d68c46caae5a69
SSDEEP

6144:gOy4B95c8NXjVmnqrqvCpJ1DEhoawm2miCTdssvdW4pX9h+OmtbzX4H4W/O7Wfyv:g895TjasjIhoJDmdvdN5YnIH40lfy+2

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

shy1.no-ip.biz:871

Mutex

DC_MUTEX-CAV8TCH

Attributes

gencode
ymht70aPLkvF
install
false
offline_keylogger
true
password
aze123456
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Suspicious use of SetThreadContext 1 IoCs

Processes:

1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

description pid process target process

PID 5116 set thread context of 2584 5116 1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe 1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 5116 set thread context of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeSecurityPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeBackupPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeRestorePrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeShutdownPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeDebugPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeUndockPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: 33	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: 34	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: 35	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
Token: 36	2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

pid process

2584 1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

pid	process
2584	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

description	pid	process	target process
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
PID 5116 wrote to memory of 2584	5116	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe	1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\Temp\1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\1b60b154aecd6b63d917dab4ed154850_JaffaCakes118.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-18-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-29-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-11-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-16-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-8-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-5-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-15-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2584-31-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-22-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-19-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-20-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-21-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-30-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-23-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-24-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-25-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-26-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-27-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-28-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2584-17-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5116-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/5116-14-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download