Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 20:58

General

  • Target

    136d9001b11fba77ae168bf0f09a7ee5_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    136d9001b11fba77ae168bf0f09a7ee5

  • SHA1

    b628cc11be2ecb992163a3ab335c0a4e31d2d573

  • SHA256

    f997497b76f240159e28d44b943a40e0ea27b6c4d7b2cdb6dc769d65bbb92544

  • SHA512

    80ba416964e3402a280b4b9dbe9e4abbfab49f029451dd4f5c1ec80a8cad8cae1438d366436168b6912492fda0108cf28d1ca16fd80d46029aef0c97a47008e3

  • SSDEEP

    24576:GE0fHw0TS/Tlr+robnykC36QNOhh0/svqus32tt4Onwp8aJRdoUepoLJlPK5Hyep:GE0fQ0TSLV+LSaOI/4FwpRpyHYm+2ah

Malware Config

Extracted

Family

darkcomet

Botnet

Finally

C2

tast.no-ip.biz:82

Mutex

DC_MUTEX-98S0K24

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    j6R1c8a9GWJZ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\136d9001b11fba77ae168bf0f09a7ee5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\136d9001b11fba77ae168bf0f09a7ee5_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Users\Admin\AppData\Local\Temp\Hacker reporter.exe
      "C:\Users\Admin\AppData\Local\Temp\Hacker reporter.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Users\Admin\AppData\Local\Temp\vbc.exe
        C:\Users\Admin\AppData\Local\Temp\vbc.exe
        3⤵
        • Modifies WinLogon for persistence
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4328
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Hacker reporter.exe" +s +h
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:760
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Users\Admin\AppData\Local\Temp\Hacker reporter.exe" +s +h
            5⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:4756
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
            PID:4048
          • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4664
            • C:\Users\Admin\AppData\Local\Temp\vbc.exe
              C:\Users\Admin\AppData\Local\Temp\vbc.exe
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1472
              • C:\Windows\SysWOW64\notepad.exe
                notepad
                6⤵
                  PID:2672
        • C:\Users\Admin\AppData\Local\Temp\Banner.exe
          "C:\Users\Admin\AppData\Local\Temp\Banner.exe"
          2⤵
          • Executes dropped EXE
          PID:3028

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Banner.exe

        Filesize

        18KB

        MD5

        463efc38869e2e4e315906d22b5e6d78

        SHA1

        01535b4ccc407affb680ac66258658c4911fb8c2

        SHA256

        4958b9f95e341ad6dcae3024013b3fcf5c5daabd3ff76a2762d731aacec752ba

        SHA512

        0be72a9e9d9bdc794e60ffd0046483374f461b32651005b95a3f1df0a8072c7e49205c3abfd6227b85b23c9261235041f7d529f41636d674105e5ee6b1a9f03b

      • C:\Users\Admin\AppData\Local\Temp\Hacker reporter.exe

        Filesize

        1.4MB

        MD5

        f3e67997c30576c80336de144362bb05

        SHA1

        3170b8ad87dc730c40d6c425869afe0a13b0e610

        SHA256

        1b7fe710b229b4b11a7fce71d190454b4dc259e54ea38f23eb2f6f8dcbe3f618

        SHA512

        d8cb6e6836626c558f6fd5ff8f92926d348950a11bb9cb9e21bb563bbd962aa51312e9297052ae60a7a9b0e015a45597ec42f5de76354bba6f74480744b92666

      • C:\Users\Admin\AppData\Local\Temp\vbc.exe

        Filesize

        1.1MB

        MD5

        d881de17aa8f2e2c08cbb7b265f928f9

        SHA1

        08936aebc87decf0af6e8eada191062b5e65ac2a

        SHA256

        b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

        SHA512

        5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

      • memory/1472-132-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-126-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-114-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-131-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-130-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-129-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-134-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-128-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-127-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-133-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-125-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-124-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-135-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-123-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-122-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-112-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-117-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/1472-116-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2672-115-0x0000000000E60000-0x0000000000E61000-memory.dmp

        Filesize

        4KB

      • memory/3028-107-0x0000000005930000-0x00000000059C2000-memory.dmp

        Filesize

        584KB

      • memory/3028-119-0x0000000005AF0000-0x0000000005B46000-memory.dmp

        Filesize

        344KB

      • memory/3028-118-0x00000000057C0000-0x00000000057CA000-memory.dmp

        Filesize

        40KB

      • memory/3028-106-0x0000000005EE0000-0x0000000006484000-memory.dmp

        Filesize

        5.6MB

      • memory/3028-105-0x0000000005890000-0x000000000592C000-memory.dmp

        Filesize

        624KB

      • memory/3028-104-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

        Filesize

        48KB

      • memory/4048-32-0x0000000000E50000-0x0000000000E51000-memory.dmp

        Filesize

        4KB

      • memory/4140-17-0x0000000075140000-0x00000000756F1000-memory.dmp

        Filesize

        5.7MB

      • memory/4140-15-0x0000000075140000-0x00000000756F1000-memory.dmp

        Filesize

        5.7MB

      • memory/4140-16-0x0000000075140000-0x00000000756F1000-memory.dmp

        Filesize

        5.7MB

      • memory/4140-29-0x0000000075140000-0x00000000756F1000-memory.dmp

        Filesize

        5.7MB

      • memory/4328-28-0x0000000002520000-0x0000000002521000-memory.dmp

        Filesize

        4KB

      • memory/4328-27-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/4328-25-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/4328-23-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/4328-20-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/4328-101-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/4532-0-0x0000000075142000-0x0000000075143000-memory.dmp

        Filesize

        4KB

      • memory/4532-121-0x0000000075140000-0x00000000756F1000-memory.dmp

        Filesize

        5.7MB

      • memory/4532-2-0x0000000075140000-0x00000000756F1000-memory.dmp

        Filesize

        5.7MB

      • memory/4532-1-0x0000000075140000-0x00000000756F1000-memory.dmp

        Filesize

        5.7MB