Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/06/2024, 05:13
General
- Target 0cb94e32616a0e542fa562c31d8eaed2_JaffaCakes118.exe
- Size 353KB
- Sample240625-fwve8sscle
- SHA256 0fff6ee44d243d507a334959012b3c631bbe3f6726fe151e25dcdb1e3d4f47c6
Malware Config
Extracted
-
darkcomet
-
Facebook16
-
mksa.dnsd.info:1606
-
DC_MUTEX-A0286Q2
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
umPqH7dAfXUN
-
install
true
-
offline_keylogger
false
-
persistence
false
-
reg_key
MicroUpdate
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cb94e32616a0e542fa562c31d8eaed2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0cb94e32616a0e542fa562c31d8eaed2_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\MSDCSC\msdcsc.exe"C:\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
msdcsc.exe
memory/2520-24-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/2520-3-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/2520-4-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/2520-2-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/2520-1-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/2520-6-0x00000000022A0000-0x00000000022A1000-memory.dmp
memory/2520-0-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-25-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-28-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-20-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-19-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-23-0x0000000002290000-0x0000000002291000-memory.dmp
memory/4452-22-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-17-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-26-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-27-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-21-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-29-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-30-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-31-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-32-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-33-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-34-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-35-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-36-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-37-0x0000000000400000-0x00000000004E5000-memory.dmp
memory/4452-38-0x0000000000400000-0x00000000004E5000-memory.dmp