Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30-04-2024 03:26

General

  • Target

    08eaff5084b9697ce7abe813eb313262_JaffaCakes118.exe

  • Size

    756KB

  • MD5

    08eaff5084b9697ce7abe813eb313262

  • SHA1

    e4a650041c5d808c37815389ade16b2503de969a

  • SHA256

    845d9c26c2473529342dd5f2c40997e76f895a08cd93acb8190faf5e2fe074ef

  • SHA512

    437dbb1b0b473609bbf152d7e23e9bab6744ccd6b1b779d8fd48fdda6edd29188b54642311f92207c618315df07b7ba07d70304ce6bdaa8433dc6fc5a885fa44

  • SSDEEP

    12288:p9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:zZ1xuVVjfFoynPaVBUR8f+kN10Ed

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

wearedotexe.no-ip.biz:200

Mutex

DC_MUTEX-R80F205

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    2bJFRYvQllRE

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08eaff5084b9697ce7abe813eb313262_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08eaff5084b9697ce7abe813eb313262_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1252

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\Documents\MSDCSC\msdcsc.exe
    Filesize

    756KB

    MD5

    08eaff5084b9697ce7abe813eb313262

    SHA1

    e4a650041c5d808c37815389ade16b2503de969a

    SHA256

    845d9c26c2473529342dd5f2c40997e76f895a08cd93acb8190faf5e2fe074ef

    SHA512

    437dbb1b0b473609bbf152d7e23e9bab6744ccd6b1b779d8fd48fdda6edd29188b54642311f92207c618315df07b7ba07d70304ce6bdaa8433dc6fc5a885fa44

  • memory/1252-18-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-17-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-13-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-14-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-19-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-16-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-26-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-25-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-15-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-20-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-21-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-22-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-23-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1252-24-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/2936-0-0x00000000003E0000-0x00000000003E1000-memory.dmp
    Filesize

    4KB

  • memory/2936-12-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB