General

  • Target

    7f2761a751bb3205b4b82ac40c62475b_JaffaCakes118

  • Size

    1013KB

  • Sample

    240801-eyyp1awdke

  • MD5

    7f2761a751bb3205b4b82ac40c62475b

  • SHA1

    bf7b8b6a7dafcd506885baf5346295fa742115ef

  • SHA256

    52b8d8b83d4fb0a23c947c9f76b2a205b6e9d4338a74eb07ecf29b2fa6289161

  • SHA512

    a94e29620be16f6e3bbc6bea9cbdbb53568c8a8470c3bfc40b823cb299fc193300ccad046d6b38a45a665e240843f811d77adb2f2513bbe617aa4bd214a33789

  • SSDEEP

    12288:y1Eu4AZ+EOJTSNT8JpclOVgvcWS2LgHtJpXMKI1jdT5yRVhJUzIwX5+9NB8GYbn3:k0GMG15eisLl74ZYS+/VRZ

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

hmmm1.no-ip.biz:1452

Mutex

DC_MUTEX-RF11TVS

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    s8N4R8Mo0z2b

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      7f2761a751bb3205b4b82ac40c62475b_JaffaCakes118

    • Size

      1013KB

    • MD5

      7f2761a751bb3205b4b82ac40c62475b

    • SHA1

      bf7b8b6a7dafcd506885baf5346295fa742115ef

    • SHA256

      52b8d8b83d4fb0a23c947c9f76b2a205b6e9d4338a74eb07ecf29b2fa6289161

    • SHA512

      a94e29620be16f6e3bbc6bea9cbdbb53568c8a8470c3bfc40b823cb299fc193300ccad046d6b38a45a665e240843f811d77adb2f2513bbe617aa4bd214a33789

    • SSDEEP

      12288:y1Eu4AZ+EOJTSNT8JpclOVgvcWS2LgHtJpXMKI1jdT5yRVhJUzIwX5+9NB8GYbn3:k0GMG15eisLl74ZYS+/VRZ

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks