darkcomet | 47b6a8be6bb6c251fdc1f69df2ce96e102fde2b1377b56fa7f5a6f0a4e57bd54

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
Size

2.3MB
MD5

1bfdbf456c611c379a667b3900acdc63
SHA1

6f14e00b5f156d1bfdcbe9c499210d8d0bd053ea
SHA256

47b6a8be6bb6c251fdc1f69df2ce96e102fde2b1377b56fa7f5a6f0a4e57bd54
SHA512

0fd918624872f5c013a86c0651fad086c69f23838464f45efd50c8a885fb680f84d1ba0e31a1f73d296158ab10b1bd0864db002417815ffa6e47e386e4fd537d
SSDEEP

49152:EudbQ1XJ6XOWhNjW2qmaVogliPJmuoqJR0cPB9W5kN7Yjo:xd9XOWK9ygliRPoq1fWmN7Yjo

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Modifies WinLogon for persistence 2 TTPs 1 IoCs
persistence

Winlogon Helper DLL
T1547.004

Modify Registry
T1112

Processes:

%tmp%.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" %tmp%.exe
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

winupdate.exe%tmp%.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate %tmp%.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	%tmp%.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	%tmp%.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe%tmp%.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	%tmp%.exe

Executes dropped EXE 2 IoCs

Processes:

%tmp%.exewinupdate.exe

pid process

3708 %tmp%.exe
1956 winupdate.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

%tmp%.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" %tmp%.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3708	%tmp%.exe
1956	winupdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	%tmp%.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winupdate.exe%tmp%.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	%tmp%.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	%tmp%.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

winupdate.exe%tmp%.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier %tmp%.exe
Modifies registry class 1 IoCs

Processes:

%tmp%.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ %tmp%.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	%tmp%.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	%tmp%.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe

pid	process
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

winupdate.exe

pid process

1956 winupdate.exe

pid	process
1956	winupdate.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe%tmp%.exewinupdate.exe

description	pid	process
Token: SeDebugPrivilege	2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3708	%tmp%.exe
Token: SeSecurityPrivilege	3708	%tmp%.exe
Token: SeTakeOwnershipPrivilege	3708	%tmp%.exe
Token: SeLoadDriverPrivilege	3708	%tmp%.exe
Token: SeSystemProfilePrivilege	3708	%tmp%.exe
Token: SeSystemtimePrivilege	3708	%tmp%.exe
Token: SeProfSingleProcessPrivilege	3708	%tmp%.exe
Token: SeIncBasePriorityPrivilege	3708	%tmp%.exe
Token: SeCreatePagefilePrivilege	3708	%tmp%.exe
Token: SeBackupPrivilege	3708	%tmp%.exe
Token: SeRestorePrivilege	3708	%tmp%.exe
Token: SeShutdownPrivilege	3708	%tmp%.exe
Token: SeDebugPrivilege	3708	%tmp%.exe
Token: SeSystemEnvironmentPrivilege	3708	%tmp%.exe
Token: SeChangeNotifyPrivilege	3708	%tmp%.exe
Token: SeRemoteShutdownPrivilege	3708	%tmp%.exe
Token: SeUndockPrivilege	3708	%tmp%.exe
Token: SeManageVolumePrivilege	3708	%tmp%.exe
Token: SeImpersonatePrivilege	3708	%tmp%.exe
Token: SeCreateGlobalPrivilege	3708	%tmp%.exe
Token: 33	3708	%tmp%.exe
Token: 34	3708	%tmp%.exe
Token: 35	3708	%tmp%.exe
Token: 36	3708	%tmp%.exe
Token: SeIncreaseQuotaPrivilege	1956	winupdate.exe
Token: SeSecurityPrivilege	1956	winupdate.exe
Token: SeTakeOwnershipPrivilege	1956	winupdate.exe
Token: SeLoadDriverPrivilege	1956	winupdate.exe
Token: SeSystemProfilePrivilege	1956	winupdate.exe
Token: SeSystemtimePrivilege	1956	winupdate.exe
Token: SeProfSingleProcessPrivilege	1956	winupdate.exe
Token: SeIncBasePriorityPrivilege	1956	winupdate.exe
Token: SeCreatePagefilePrivilege	1956	winupdate.exe
Token: SeBackupPrivilege	1956	winupdate.exe
Token: SeRestorePrivilege	1956	winupdate.exe
Token: SeShutdownPrivilege	1956	winupdate.exe
Token: SeDebugPrivilege	1956	winupdate.exe
Token: SeSystemEnvironmentPrivilege	1956	winupdate.exe
Token: SeChangeNotifyPrivilege	1956	winupdate.exe
Token: SeRemoteShutdownPrivilege	1956	winupdate.exe
Token: SeUndockPrivilege	1956	winupdate.exe
Token: SeManageVolumePrivilege	1956	winupdate.exe
Token: SeImpersonatePrivilege	1956	winupdate.exe
Token: SeCreateGlobalPrivilege	1956	winupdate.exe
Token: 33	1956	winupdate.exe
Token: 34	1956	winupdate.exe
Token: 35	1956	winupdate.exe
Token: 36	1956	winupdate.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe%tmp%.exe

description	pid	process	target process
PID 2708 wrote to memory of 3708	2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe	%tmp%.exe
PID 2708 wrote to memory of 3708	2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe	%tmp%.exe
PID 2708 wrote to memory of 3708	2708	1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe	%tmp%.exe
PID 3708 wrote to memory of 1956	3708	%tmp%.exe	winupdate.exe
PID 3708 wrote to memory of 1956	3708	%tmp%.exe	winupdate.exe
PID 3708 wrote to memory of 1956	3708	%tmp%.exe	winupdate.exe

C:\Users\Admin\AppData\Local\Temp\1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bfdbf456c611c379a667b3900acdc63_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
"C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"
2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windupdt\winupdate.exe
"C:\Windupdt\winupdate.exe"
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4544,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:2664

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
Filesize
812KB

MD5
712e5d085ff3cea9e52a6f5145839952

SHA1
0926d754dbf29ca31cbd8dd0aaa29b4e989bef2c

SHA256
1450db183a44af494827b61e91c5b3860e711644703ff0c63d9ec0f48c7c93d0

SHA512
57d49c3fcd29b1afd23f11ba23684676572045f1f39315d5362078fc06ada1a95a2b3a03fb3eebaf5c74e2bbb56fa86401d260784308b5a3e6056cae1a5d1554

Download Submit
memory/1956-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-58-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-53-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-62-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-51-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-52-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-60-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-56-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1956-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2708-2-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download
memory/2708-0-0x0000000074E42000-0x0000000074E43000-memory.dmp

Filesize
4KB

Download
memory/2708-1-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download
memory/2708-14-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download
memory/3708-50-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3708-15-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download