darkcomet | 9740492962928aafcfc3823083ab7e1b092afdbccc830c607f01019537b80407

General

Target

63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Size

398KB
MD5

63cbce809a2813c3a62433cd1a71ece6
SHA1

611253d54dd926899e9e6d7607ef137a3a1562c1
SHA256

9740492962928aafcfc3823083ab7e1b092afdbccc830c607f01019537b80407
SHA512

6febbe6f6feb7b4159e97bbd8398fe08144463f99a16e7d0f10e05e62d2d0b516d12775fb0999dfd1716260b0e06dcfe242fdd2ed44201c89e285b16b4c04370
SSDEEP

6144:vcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0P8jWqYooSAHuIZ2GmJ6SXOk:vcWkbgTYWnYnt/IDYhPKWThDuIlm/O

Score

10^/10

darkcomet fack you persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

FACK YOU

C2

mfashi.ddns.net:1995

192.168.0.102:1995

Mutex

DC_MUTEX-RRN2THV

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
ADipTpuqkEHM
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2636 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe

pid process

2820 63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
2820 63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe

pid	process
2636	msdcsc.exe

pid	process
2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2820-60-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe	upx
behavioral1/memory/2636-18-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/2820-17-0x0000000004190000-0x000000000426C000-memory.dmp	upx
behavioral1/memory/2820-0-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/2636-61-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/2636-64-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/2636-66-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/2636-69-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/2636-71-0x0000000000400000-0x00000000004DC000-memory.dmp	upx
behavioral1/memory/2636-73-0x0000000000400000-0x00000000004DC000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeSecurityPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeBackupPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeRestorePrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeShutdownPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeDebugPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeUndockPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: 33	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: 34	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: 35	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2636	msdcsc.exe
Token: SeSecurityPrivilege	2636	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2636	msdcsc.exe
Token: SeLoadDriverPrivilege	2636	msdcsc.exe
Token: SeSystemProfilePrivilege	2636	msdcsc.exe
Token: SeSystemtimePrivilege	2636	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2636	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2636	msdcsc.exe
Token: SeCreatePagefilePrivilege	2636	msdcsc.exe
Token: SeBackupPrivilege	2636	msdcsc.exe
Token: SeRestorePrivilege	2636	msdcsc.exe
Token: SeShutdownPrivilege	2636	msdcsc.exe
Token: SeDebugPrivilege	2636	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2636	msdcsc.exe
Token: SeChangeNotifyPrivilege	2636	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2636	msdcsc.exe
Token: SeUndockPrivilege	2636	msdcsc.exe
Token: SeManageVolumePrivilege	2636	msdcsc.exe
Token: SeImpersonatePrivilege	2636	msdcsc.exe
Token: SeCreateGlobalPrivilege	2636	msdcsc.exe
Token: 33	2636	msdcsc.exe
Token: 34	2636	msdcsc.exe
Token: 35	2636	msdcsc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2920 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2636 msdcsc.exe

pid	process
2920	DllHost.exe

pid	process
2636	msdcsc.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exemsdcsc.exe

description	pid	process	target process
PID 2820 wrote to memory of 2636	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe	msdcsc.exe
PID 2820 wrote to memory of 2636	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe	msdcsc.exe
PID 2820 wrote to memory of 2636	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe	msdcsc.exe
PID 2820 wrote to memory of 2636	2820	63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe	msdcsc.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe
PID 2636 wrote to memory of 2596	2636	msdcsc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63cbce809a2813c3a62433cd1a71ece6_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2596

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LTHO0NZGK1Y.JPG

Filesize
135KB

MD5
9e0897de252ddb54f53daae74feccc38

SHA1
fbc9d72751edd523ed13121941df428c350532c0

SHA256
bc1972daaded3ee83c0279d1f31e7f47cd1fd6281be724d45f31004827fe4ed1

SHA512
c3baabdffb82bba424226f14317bb17bfe08c9fa30bae4d8a8919cf646f24f1793d40b3029e3e152a6aa9ec7fbe9169d74e01f83aa0c8202a970e0d664e6a29a

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
398KB

MD5
63cbce809a2813c3a62433cd1a71ece6

SHA1
611253d54dd926899e9e6d7607ef137a3a1562c1

SHA256
9740492962928aafcfc3823083ab7e1b092afdbccc830c607f01019537b80407

SHA512
6febbe6f6feb7b4159e97bbd8398fe08144463f99a16e7d0f10e05e62d2d0b516d12775fb0999dfd1716260b0e06dcfe242fdd2ed44201c89e285b16b4c04370

Download Submit
memory/2596-59-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2596-21-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2636-64-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2636-69-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2636-18-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2636-73-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2636-61-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2636-71-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2636-66-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2820-17-0x0000000004190000-0x000000000426C000-memory.dmp

Filesize
880KB

Download
memory/2820-19-0x0000000004190000-0x000000000426C000-memory.dmp

Filesize
880KB

Download
memory/2820-5-0x0000000002300000-0x0000000002302000-memory.dmp

Filesize
8KB

Download
memory/2820-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2820-0-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2820-60-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2920-7-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2920-62-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2920-6-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads