darkcomet | fba5cb745a133db3a20043a8a255515a43e851cd22218688b76b7f5fad4a6108

General

Target

0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Size

709KB
MD5

0104907eed9e54c2419933d635c8882b
SHA1

1e492614b76775c37f5bf453dabf10f459231f16
SHA256

fba5cb745a133db3a20043a8a255515a43e851cd22218688b76b7f5fad4a6108
SHA512

fb4d3b6a020c4c6aaa5f3854c91aa84918fb3b327bdbbce11f67c972bfa8d4940f2b6b27b9134c6ddba051e7f5346b975e7754323aca967af73258958d924936
SSDEEP

12288:Y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hwe5V9w5P:MZ1xuVVjfFoynPaVBUR8f+kN10EBSOVa

Score

10^/10

darkcomet new evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

New

C2

guadagnareonline.hopto.org:1604

Mutex

DC_MUTEX-STBVEMZ

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Usi3icsCEkiS
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2884 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe

pid process

2824 0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
2824 0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe

pid	process
2884	msdcsc.exe

pid	process
2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2884 msdcsc.exe

pid	process
2884	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

0104907eed9e54c2419933d635c8882b_JaffaCakes118.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeSecurityPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeBackupPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeRestorePrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeShutdownPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeDebugPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeUndockPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: 33	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: 34	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: 35	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2884	msdcsc.exe
Token: SeSecurityPrivilege	2884	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2884	msdcsc.exe
Token: SeLoadDriverPrivilege	2884	msdcsc.exe
Token: SeSystemProfilePrivilege	2884	msdcsc.exe
Token: SeSystemtimePrivilege	2884	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2884	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2884	msdcsc.exe
Token: SeCreatePagefilePrivilege	2884	msdcsc.exe
Token: SeBackupPrivilege	2884	msdcsc.exe
Token: SeRestorePrivilege	2884	msdcsc.exe
Token: SeShutdownPrivilege	2884	msdcsc.exe
Token: SeDebugPrivilege	2884	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2884	msdcsc.exe
Token: SeChangeNotifyPrivilege	2884	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2884	msdcsc.exe
Token: SeUndockPrivilege	2884	msdcsc.exe
Token: SeManageVolumePrivilege	2884	msdcsc.exe
Token: SeImpersonatePrivilege	2884	msdcsc.exe
Token: SeCreateGlobalPrivilege	2884	msdcsc.exe
Token: 33	2884	msdcsc.exe
Token: 34	2884	msdcsc.exe
Token: 35	2884	msdcsc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1504 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2884 msdcsc.exe

pid	process
1504	DllHost.exe

pid	process
2884	msdcsc.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

0104907eed9e54c2419933d635c8882b_JaffaCakes118.exemsdcsc.exe

description	pid	process	target process
PID 2824 wrote to memory of 2884	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe	msdcsc.exe
PID 2824 wrote to memory of 2884	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe	msdcsc.exe
PID 2824 wrote to memory of 2884	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe	msdcsc.exe
PID 2824 wrote to memory of 2884	2824	0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe	msdcsc.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe
PID 2884 wrote to memory of 2664	2884	msdcsc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0104907eed9e54c2419933d635c8882b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2664

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\678284.JPG
Filesize
50KB

MD5
171ad32492c210b1ec2b5acf14a7b3df

SHA1
88c47cdbfadb499472d9a4422d1472a46735382d

SHA256
328f46577ce54218554fd64741df5485ae92b27e00a4dab6c094e9d676929d72

SHA512
a08b1b274cbbfaf1e295ac0390057146791b53c59473be7a13372311143a329cb654fa4f530eefe9a67a49a26ae8691e4bd44a61d48b7a867b8c31a4510ae3b6

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
709KB

MD5
0104907eed9e54c2419933d635c8882b

SHA1
1e492614b76775c37f5bf453dabf10f459231f16

SHA256
fba5cb745a133db3a20043a8a255515a43e851cd22218688b76b7f5fad4a6108

SHA512
fb4d3b6a020c4c6aaa5f3854c91aa84918fb3b327bdbbce11f67c972bfa8d4940f2b6b27b9134c6ddba051e7f5346b975e7754323aca967af73258958d924936

Download Submit
memory/1504-59-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/1504-5-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/1504-6-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2664-17-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2664-55-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2824-4-0x00000000007C0000-0x00000000007C2000-memory.dmp

Filesize
8KB

Download
memory/2824-56-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2824-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2884-60-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-65-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-57-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-61-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-62-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-63-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-64-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-58-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-66-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-67-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-68-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-69-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-70-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2884-71-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads