Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
13/07/2024, 04:34
General
- Target 403810510509640b54651a96c31e6f92_JaffaCakes118.exe
- Size 522KB
- Sample240713-e662cawcln
- SHA256 b3552459fb71db9b71cf769f67d8794fad7db5568b9c4cfa189f532e71a83f39
Malware Config
Extracted
-
darkcomet
-
Guest16
-
m20sh9.no-ip.org:1515
-
DC_MUTEX-5C2P2UP
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
98X29pBtiSv1
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 6 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\403810510509640b54651a96c31e6f92_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\403810510509640b54651a96c31e6f92_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
msdcsc.exe
memory/3648-5-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-38-0x0000000002390000-0x0000000002391000-memory.dmp
memory/3648-1-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-11-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-34-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-33-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-32-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-31-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-30-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-29-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-28-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-27-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-26-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-25-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-24-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-23-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-22-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-21-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-20-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-19-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-17-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-18-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-16-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-15-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-14-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-10-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-9-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-7-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-6-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-2-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-8-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-4-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-0-0x0000000000400000-0x000000000052A000-memory.dmp
memory/3648-13-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-35-0x0000000002490000-0x0000000002493000-memory.dmp
memory/3648-3-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3648-42-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/3648-41-0x00000000024C0000-0x00000000024C1000-memory.dmp
memory/3648-40-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/3648-39-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/3648-37-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-36-0x0000000002480000-0x0000000002481000-memory.dmp
memory/3648-46-0x0000000002520000-0x0000000002521000-memory.dmp
memory/3648-45-0x0000000002530000-0x0000000002531000-memory.dmp
memory/3648-12-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3648-59-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-67-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-69-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-61-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-62-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-63-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-57-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-60-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-65-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-64-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-68-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-66-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-70-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-71-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-72-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4796-73-0x0000000000400000-0x000000000052A000-memory.dmp