Overview

overview

10

Static

static

3

56de02f511...18.exe

windows7-x64

1

56de02f511...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/07/2024, 09:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    56de02f511a77b3c279cf407f179b08e_JaffaCakes118.exe
  • Size 891KB
  • Sample240718-lysbjswhle
  • SHA256 d5fc1ce7663059bf5c0d7892c4b0cf69c84e73764a32ebfeb555745e0aad9ece
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\56de02f511a77b3c279cf407f179b08e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\56de02f511a77b3c279cf407f179b08e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\56de02f511a77b3c279cf407f179b08e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\56de02f511a77b3c279cf407f179b08e_JaffaCakes118.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\56de02f511a77b3c279cf407f179b08e_JaffaCakes118.exe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\56de02f511a77b3c279cf407f179b08e_JaffaCakes118.exe" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:3596
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4140
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:3160
      • C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
        "C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
          C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
          4⤵
            PID:3788

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          msdcsc.exe
          • Path C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
          • Size 891KB
          • SHA256 d5fc1ce7663059bf5c0d7892c4b0cf69c84e73764a32ebfeb555745e0aad9ece
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1396-0-0x0000000075202000-0x0000000075203000-memory.dmp
          Download

          memory/1396-1-0x0000000075200000-0x00000000757B1000-memory.dmp
          Download

          memory/1396-2-0x0000000075200000-0x00000000757B1000-memory.dmp
          Download

          memory/1396-8-0x0000000075200000-0x00000000757B1000-memory.dmp
          Download

          memory/4320-3-0x0000000000400000-0x00000000004AF000-memory.dmp
          Download

          memory/4320-4-0x0000000000400000-0x00000000004AF000-memory.dmp
          Download

          memory/4320-6-0x0000000000400000-0x00000000004AF000-memory.dmp
          Download

          memory/4320-7-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
          Download