Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 21:48

General

  • Target

    17a6cf62409d259d281c82ae00259d66_JaffaCakes118.exe

  • Size

    700KB

  • MD5

    17a6cf62409d259d281c82ae00259d66

  • SHA1

    15c2bccc3f8bc41190eaa6b49da6c99eccf1602d

  • SHA256

    1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64

  • SHA512

    2d0e56b9117b7dd0f6f1910dad82b09f9e1d693d238422498c93c3d14e6de7ebdef4bd0decfc20582305b1ed41db98ff4bd447da72181dc97e6aa8601fd6110b

  • SSDEEP

    12288:/yPPQ1ufEoYFwm4jFySBXY3sHuss0dtyxvlrKnnmRjVLPrJHbFJ8:/yPPMpoY6HXY3Kusfexv4n6jVLxc

Malware Config

Extracted

Family

darkcomet

Botnet

åååååååååå

C2

ogdd.servemp3.com:4433

Mutex

DC_MUTEX-LGYC4QH

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    7UYk2EHbmDiQ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66_JaffaCakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

    Filesize

    700KB

    MD5

    17a6cf62409d259d281c82ae00259d66

    SHA1

    15c2bccc3f8bc41190eaa6b49da6c99eccf1602d

    SHA256

    1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64

    SHA512

    2d0e56b9117b7dd0f6f1910dad82b09f9e1d693d238422498c93c3d14e6de7ebdef4bd0decfc20582305b1ed41db98ff4bd447da72181dc97e6aa8601fd6110b

  • memory/2540-84-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-83-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-82-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-80-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-79-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-78-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-77-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-75-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-74-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-73-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-71-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-70-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-66-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-67-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-64-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-65-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2540-63-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2708-53-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

  • memory/2708-42-0x0000000000300000-0x0000000000310000-memory.dmp

    Filesize

    64KB

  • memory/2708-41-0x00000000002F0000-0x0000000000300000-memory.dmp

    Filesize

    64KB

  • memory/2708-43-0x0000000000310000-0x0000000000320000-memory.dmp

    Filesize

    64KB

  • memory/2708-44-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

  • memory/2708-45-0x0000000000330000-0x0000000000340000-memory.dmp

    Filesize

    64KB

  • memory/2708-38-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

  • memory/2708-39-0x00000000002C0000-0x00000000002D0000-memory.dmp

    Filesize

    64KB

  • memory/2708-40-0x00000000002D0000-0x00000000002E0000-memory.dmp

    Filesize

    64KB

  • memory/2708-54-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

  • memory/2708-46-0x0000000000340000-0x0000000000350000-memory.dmp

    Filesize

    64KB

  • memory/2708-52-0x00000000003A0000-0x00000000003B0000-memory.dmp

    Filesize

    64KB

  • memory/2708-51-0x0000000000390000-0x00000000003A0000-memory.dmp

    Filesize

    64KB

  • memory/2708-50-0x0000000000380000-0x0000000000390000-memory.dmp

    Filesize

    64KB

  • memory/2708-49-0x0000000000370000-0x0000000000380000-memory.dmp

    Filesize

    64KB

  • memory/2708-48-0x0000000000360000-0x0000000000370000-memory.dmp

    Filesize

    64KB

  • memory/2708-47-0x0000000000350000-0x0000000000360000-memory.dmp

    Filesize

    64KB

  • memory/2932-5-0x0000000000330000-0x0000000000340000-memory.dmp

    Filesize

    64KB

  • memory/2932-14-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

  • memory/2932-4-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

  • memory/2932-15-0x00000000003E0000-0x00000000003F0000-memory.dmp

    Filesize

    64KB

  • memory/2932-13-0x00000000003C0000-0x00000000003D0000-memory.dmp

    Filesize

    64KB

  • memory/2932-12-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

  • memory/2932-0-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

  • memory/2932-1-0x0000000000270000-0x0000000000280000-memory.dmp

    Filesize

    64KB

  • memory/2932-2-0x0000000000280000-0x0000000000290000-memory.dmp

    Filesize

    64KB

  • memory/2932-3-0x0000000000310000-0x0000000000320000-memory.dmp

    Filesize

    64KB

  • memory/2932-16-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/2932-11-0x0000000000390000-0x00000000003A0000-memory.dmp

    Filesize

    64KB

  • memory/2932-7-0x0000000000350000-0x0000000000360000-memory.dmp

    Filesize

    64KB

  • memory/2932-6-0x0000000000340000-0x0000000000350000-memory.dmp

    Filesize

    64KB

  • memory/2932-9-0x0000000000370000-0x0000000000380000-memory.dmp

    Filesize

    64KB

  • memory/2932-8-0x0000000000360000-0x0000000000370000-memory.dmp

    Filesize

    64KB

  • memory/2932-17-0x00000000005F0000-0x0000000000600000-memory.dmp

    Filesize

    64KB

  • memory/2932-10-0x0000000000380000-0x0000000000390000-memory.dmp

    Filesize

    64KB

  • memory/2976-20-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2976-22-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2976-21-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2976-68-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2976-23-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2976-24-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB