darkcomet | 47b6a8be6bb6c251fdc1f69df2ce96e102fde2b1377b56fa7f5a6f0a4e57bd54

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
Size

2.3MB
MD5

1bfdbf456c611c379a667b3900acdc63
SHA1

6f14e00b5f156d1bfdcbe9c499210d8d0bd053ea
SHA256

47b6a8be6bb6c251fdc1f69df2ce96e102fde2b1377b56fa7f5a6f0a4e57bd54
SHA512

0fd918624872f5c013a86c0651fad086c69f23838464f45efd50c8a885fb680f84d1ba0e31a1f73d296158ab10b1bd0864db002417815ffa6e47e386e4fd537d
SSDEEP

49152:EudbQ1XJ6XOWhNjW2qmaVogliPJmuoqJR0cPB9W5kN7Yjo:xd9XOWK9ygliRPoq1fWmN7Yjo

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Modifies WinLogon for persistence 2 TTPs 1 IoCs
persistence

Winlogon Helper DLL
T1547.004

Modify Registry
T1112

Processes:

%tmp%.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" %tmp%.exe
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

winupdate.exe%tmp%.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate %tmp%.exe
Executes dropped EXE 2 IoCs

Processes:

%tmp%.exewinupdate.exe

pid process

2792 %tmp%.exe
2920 winupdate.exe
Loads dropped DLL 6 IoCs

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe%tmp%.exewinupdate.exe

pid process

2220 1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220 1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2792 %tmp%.exe
2920 winupdate.exe
2920 winupdate.exe
2920 winupdate.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

%tmp%.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" %tmp%.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	%tmp%.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	%tmp%.exe

pid	process
2792	%tmp%.exe
2920	winupdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	%tmp%.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winupdate.exe%tmp%.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	%tmp%.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

%tmp%.exewinupdate.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier %tmp%.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe

pid	process
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

winupdate.exe

pid process

2920 winupdate.exe

pid	process
2920	winupdate.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe%tmp%.exewinupdate.exe

description	pid	process
Token: SeDebugPrivilege	2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2792	%tmp%.exe
Token: SeSecurityPrivilege	2792	%tmp%.exe
Token: SeTakeOwnershipPrivilege	2792	%tmp%.exe
Token: SeLoadDriverPrivilege	2792	%tmp%.exe
Token: SeSystemProfilePrivilege	2792	%tmp%.exe
Token: SeSystemtimePrivilege	2792	%tmp%.exe
Token: SeProfSingleProcessPrivilege	2792	%tmp%.exe
Token: SeIncBasePriorityPrivilege	2792	%tmp%.exe
Token: SeCreatePagefilePrivilege	2792	%tmp%.exe
Token: SeBackupPrivilege	2792	%tmp%.exe
Token: SeRestorePrivilege	2792	%tmp%.exe
Token: SeShutdownPrivilege	2792	%tmp%.exe
Token: SeDebugPrivilege	2792	%tmp%.exe
Token: SeSystemEnvironmentPrivilege	2792	%tmp%.exe
Token: SeChangeNotifyPrivilege	2792	%tmp%.exe
Token: SeRemoteShutdownPrivilege	2792	%tmp%.exe
Token: SeUndockPrivilege	2792	%tmp%.exe
Token: SeManageVolumePrivilege	2792	%tmp%.exe
Token: SeImpersonatePrivilege	2792	%tmp%.exe
Token: SeCreateGlobalPrivilege	2792	%tmp%.exe
Token: 33	2792	%tmp%.exe
Token: 34	2792	%tmp%.exe
Token: 35	2792	%tmp%.exe
Token: SeIncreaseQuotaPrivilege	2920	winupdate.exe
Token: SeSecurityPrivilege	2920	winupdate.exe
Token: SeTakeOwnershipPrivilege	2920	winupdate.exe
Token: SeLoadDriverPrivilege	2920	winupdate.exe
Token: SeSystemProfilePrivilege	2920	winupdate.exe
Token: SeSystemtimePrivilege	2920	winupdate.exe
Token: SeProfSingleProcessPrivilege	2920	winupdate.exe
Token: SeIncBasePriorityPrivilege	2920	winupdate.exe
Token: SeCreatePagefilePrivilege	2920	winupdate.exe
Token: SeBackupPrivilege	2920	winupdate.exe
Token: SeRestorePrivilege	2920	winupdate.exe
Token: SeShutdownPrivilege	2920	winupdate.exe
Token: SeDebugPrivilege	2920	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2920	winupdate.exe
Token: SeChangeNotifyPrivilege	2920	winupdate.exe
Token: SeRemoteShutdownPrivilege	2920	winupdate.exe
Token: SeUndockPrivilege	2920	winupdate.exe
Token: SeManageVolumePrivilege	2920	winupdate.exe
Token: SeImpersonatePrivilege	2920	winupdate.exe
Token: SeCreateGlobalPrivilege	2920	winupdate.exe
Token: 33	2920	winupdate.exe
Token: 34	2920	winupdate.exe
Token: 35	2920	winupdate.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe%tmp%.exe

description	pid	process	target process
PID 2220 wrote to memory of 2792	2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe	%tmp%.exe
PID 2220 wrote to memory of 2792	2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe	%tmp%.exe
PID 2220 wrote to memory of 2792	2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe	%tmp%.exe
PID 2220 wrote to memory of 2792	2220	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe	%tmp%.exe
PID 2792 wrote to memory of 2920	2792	%tmp%.exe	winupdate.exe
PID 2792 wrote to memory of 2920	2792	%tmp%.exe	winupdate.exe
PID 2792 wrote to memory of 2920	2792	%tmp%.exe	winupdate.exe
PID 2792 wrote to memory of 2920	2792	%tmp%.exe	winupdate.exe
PID 2792 wrote to memory of 2920	2792	%tmp%.exe	winupdate.exe
PID 2792 wrote to memory of 2920	2792	%tmp%.exe	winupdate.exe
PID 2792 wrote to memory of 2920	2792	%tmp%.exe	winupdate.exe

C:\Users\Admin\AppData\Local\Temp\1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
"C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"
2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windupdt\winupdate.exe
"C:\Windupdt\winupdate.exe"
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\%tmp%.exe
Filesize
812KB

MD5
712e5d085ff3cea9e52a6f5145839952

SHA1
0926d754dbf29ca31cbd8dd0aaa29b4e989bef2c

SHA256
1450db183a44af494827b61e91c5b3860e711644703ff0c63d9ec0f48c7c93d0

SHA512
57d49c3fcd29b1afd23f11ba23684676572045f1f39315d5362078fc06ada1a95a2b3a03fb3eebaf5c74e2bbb56fa86401d260784308b5a3e6056cae1a5d1554

Download Submit
memory/2220-0-0x0000000074301000-0x0000000074302000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2220-2-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2220-13-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2792-14-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2792-24-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-32-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-30-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-31-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-29-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-33-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-34-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-35-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-36-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-37-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-38-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-39-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-40-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2920-41-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download