Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-04-2024 03:26

General

  • Target

    08eaff5084b9697ce7abe813eb313262_JaffaCakes118.exe

  • Size

    756KB

  • MD5

    08eaff5084b9697ce7abe813eb313262

  • SHA1

    e4a650041c5d808c37815389ade16b2503de969a

  • SHA256

    845d9c26c2473529342dd5f2c40997e76f895a08cd93acb8190faf5e2fe074ef

  • SHA512

    437dbb1b0b473609bbf152d7e23e9bab6744ccd6b1b779d8fd48fdda6edd29188b54642311f92207c618315df07b7ba07d70304ce6bdaa8433dc6fc5a885fa44

  • SSDEEP

    12288:p9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:zZ1xuVVjfFoynPaVBUR8f+kN10Ed

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

wearedotexe.no-ip.biz:200

Mutex

DC_MUTEX-R80F205

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    2bJFRYvQllRE

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08eaff5084b9697ce7abe813eb313262_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08eaff5084b9697ce7abe813eb313262_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    Filesize

    756KB

    MD5

    08eaff5084b9697ce7abe813eb313262

    SHA1

    e4a650041c5d808c37815389ade16b2503de969a

    SHA256

    845d9c26c2473529342dd5f2c40997e76f895a08cd93acb8190faf5e2fe074ef

    SHA512

    437dbb1b0b473609bbf152d7e23e9bab6744ccd6b1b779d8fd48fdda6edd29188b54642311f92207c618315df07b7ba07d70304ce6bdaa8433dc6fc5a885fa44

  • memory/1368-67-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-64-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-68-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-63-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-69-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-65-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-66-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-70-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-76-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-61-0x00000000009F0000-0x00000000009F1000-memory.dmp
    Filesize

    4KB

  • memory/1368-75-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-71-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-72-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-73-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/1368-74-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB

  • memory/3876-0-0x00000000006E0000-0x00000000006E1000-memory.dmp
    Filesize

    4KB

  • memory/3876-62-0x0000000000400000-0x00000000004CA000-memory.dmp
    Filesize

    808KB