darkcomet | f76c7db479887e9ed2185329fa5724f1dad254c88d3553f413dba0d2a920ad3c

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a43210f401834932b515731deb398f9_JaffaCakes118.exe
Size 1.1MB
Sample240628-qh5dds1eqd
SHA256 f76c7db479887e9ed2185329fa5724f1dad254c88d3553f413dba0d2a920ad3c
MD5 1a43210f401834932b515731deb398f9
SHA1 22820a8fefa82a6a52004522027067c5a98457f7
SHA512 9b6db7e0102d1aa526ab375edcdab0e4348f664e268b522f7d928ac70d1593e25784ea3dbfaeb08b893e7142657f29eaa6baa4980125cf08d20d0da4e8b4dbb1
SSDEEP 24576:UgjUgmqZ5n6tkjR26s2ZKTWm9cwfThY5HW5F2vvRef1taxih1oQ:ljU1q6ta2IWWmuMTeHW74vRm6Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	675.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	675.exe

Executes dropped EXE 2 IoCs

pid	Process
4872	675.exe
4788	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	675.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4788	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4872	675.exe
Token: SeSecurityPrivilege	4872	675.exe
Token: SeTakeOwnershipPrivilege	4872	675.exe
Token: SeLoadDriverPrivilege	4872	675.exe
Token: SeSystemProfilePrivilege	4872	675.exe
Token: SeSystemtimePrivilege	4872	675.exe
Token: SeProfSingleProcessPrivilege	4872	675.exe
Token: SeIncBasePriorityPrivilege	4872	675.exe
Token: SeCreatePagefilePrivilege	4872	675.exe
Token: SeBackupPrivilege	4872	675.exe
Token: SeRestorePrivilege	4872	675.exe
Token: SeShutdownPrivilege	4872	675.exe
Token: SeDebugPrivilege	4872	675.exe
Token: SeSystemEnvironmentPrivilege	4872	675.exe
Token: SeChangeNotifyPrivilege	4872	675.exe
Token: SeRemoteShutdownPrivilege	4872	675.exe
Token: SeUndockPrivilege	4872	675.exe
Token: SeManageVolumePrivilege	4872	675.exe
Token: SeImpersonatePrivilege	4872	675.exe
Token: SeCreateGlobalPrivilege	4872	675.exe
Token: 33	4872	675.exe
Token: 34	4872	675.exe
Token: 35	4872	675.exe
Token: 36	4872	675.exe
Token: SeIncreaseQuotaPrivilege	4788	msdcsc.exe
Token: SeSecurityPrivilege	4788	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4788	msdcsc.exe
Token: SeLoadDriverPrivilege	4788	msdcsc.exe
Token: SeSystemProfilePrivilege	4788	msdcsc.exe
Token: SeSystemtimePrivilege	4788	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4788	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4788	msdcsc.exe
Token: SeCreatePagefilePrivilege	4788	msdcsc.exe
Token: SeBackupPrivilege	4788	msdcsc.exe
Token: SeRestorePrivilege	4788	msdcsc.exe
Token: SeShutdownPrivilege	4788	msdcsc.exe
Token: SeDebugPrivilege	4788	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4788	msdcsc.exe
Token: SeChangeNotifyPrivilege	4788	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4788	msdcsc.exe
Token: SeUndockPrivilege	4788	msdcsc.exe
Token: SeManageVolumePrivilege	4788	msdcsc.exe
Token: SeImpersonatePrivilege	4788	msdcsc.exe
Token: SeCreateGlobalPrivilege	4788	msdcsc.exe
Token: 33	4788	msdcsc.exe
Token: 34	4788	msdcsc.exe
Token: 35	4788	msdcsc.exe
Token: 36	4788	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4788	msdcsc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4872	4884	1a43210f401834932b515731deb398f9_JaffaCakes118.exe	82
PID 4884 wrote to memory of 4872	4884	1a43210f401834932b515731deb398f9_JaffaCakes118.exe	82
PID 4884 wrote to memory of 4872	4884	1a43210f401834932b515731deb398f9_JaffaCakes118.exe	82
PID 4872 wrote to memory of 4788	4872	675.exe	83
PID 4872 wrote to memory of 4788	4872	675.exe	83
PID 4872 wrote to memory of 4788	4872	675.exe	83
PID 4788 wrote to memory of 3408	4788	msdcsc.exe	84
PID 4788 wrote to memory of 3408	4788	msdcsc.exe	84
PID 4788 wrote to memory of 3408	4788	msdcsc.exe	84
PID 4788 wrote to memory of 900	4788	msdcsc.exe	85
PID 4788 wrote to memory of 900	4788	msdcsc.exe	85

C:\Users\Admin\AppData\Local\Temp\1a43210f401834932b515731deb398f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a43210f401834932b515731deb398f9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\675.exe
  C:\Users\Admin\AppData\Local\Temp\675.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:3408
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

675.exe

Path C:\Users\Admin\AppData\Local\Temp\675.exe
Size 848KB
SHA256 3e47503c31311544f1a78a19bae880909138eea6459a40532674bde19130c448
MD5 c3117f0ae622f67dc68c178ae1663a8c
SHA1 7160e08fca4f08d426437589bc9ce571a575606b
SHA512 2c32cfd7b4a7b2a3c525501bac302eab3b449a46c38b4dd658fb8281efbc8222fc8691911860a0a54cabbedb20f0ea027e6452d26ea6c5dc5ad9c720f2b9183c
SSDEEP 24576:i3nbWmJVJFwSddIXvfhqbiaxvRxq9kkS4f4:camdZdcBYNkS4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4788-35-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-30-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-41-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-40-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-39-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-38-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-29-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-37-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-36-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-27-0x00000000021B0000-0x00000000021B1000-memory.dmp

Download

memory/4788-28-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-33-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-34-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-31-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4788-32-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4872-14-0x00000000022E0000-0x00000000022E1000-memory.dmp

Download

memory/4872-26-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/4884-2-0x000000001B7C0000-0x000000001BC8E000-memory.dmp

Download

memory/4884-0-0x00007FFAC12F5000-0x00007FFAC12F6000-memory.dmp

Download

memory/4884-13-0x00007FFAC1040000-0x00007FFAC19E1000-memory.dmp

Download

memory/4884-15-0x00007FFAC1040000-0x00007FFAC19E1000-memory.dmp

Download

memory/4884-1-0x00007FFAC1040000-0x00007FFAC19E1000-memory.dmp

Download

memory/4884-4-0x000000001B1E0000-0x000000001B286000-memory.dmp

Download

memory/4884-3-0x000000001BC90000-0x000000001BECE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads