Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01-08-2024 17:31

General

  • Target

    8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe

  • Size

    598KB

  • MD5

    8164c48d6dd6cc20309bdc5c8135561b

  • SHA1

    39bd3d2ac36b7461f541c4b861d067c48024742c

  • SHA256

    9aa3ce52260ba0914639a1a63a8c2447563578e8167c50f8a541f542e0f615e8

  • SHA512

    ff28fafcded7e56a99a8e8c7a1e8976c5890cc271ad98bf8296e8366dee05ed4e6acdc83125e5c5bfa2984d288bd9d0d9a59245a1f8ff5bbd109812a9a3d40e1

  • SSDEEP

    12288:wY89kymZ1iptv+qKhFc9mO9HaN2n6jygDAUJ2sc30Xy5SO0PEo:cWymZ1iD+qKhSmOb6rbJu3Ps1

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

mohamedmmk.zapto.org:82

Mutex

DC_MUTEX-L1KB0QQ

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    LN0J2LLsllhH

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Users\Admin\AppData\Local\Temp\8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe
      8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe
      2⤵
        PID:860
      • C:\Users\Admin\AppData\Local\Temp\8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe
        8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:768
        • C:\Users\Admin\AppData\Local\Temp\8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\8164c48d6dd6cc20309bdc5c8135561b_JaffaCakes118.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
              msdcsc.exe
              5⤵
                PID:2648
              • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                msdcsc.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3048
                • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:1652

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\Documents\MSDCSC\msdcsc.exe

        Filesize

        598KB

        MD5

        8164c48d6dd6cc20309bdc5c8135561b

        SHA1

        39bd3d2ac36b7461f541c4b861d067c48024742c

        SHA256

        9aa3ce52260ba0914639a1a63a8c2447563578e8167c50f8a541f542e0f615e8

        SHA512

        ff28fafcded7e56a99a8e8c7a1e8976c5890cc271ad98bf8296e8366dee05ed4e6acdc83125e5c5bfa2984d288bd9d0d9a59245a1f8ff5bbd109812a9a3d40e1

      • memory/768-11-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-13-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-9-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-3-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/768-14-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-12-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-6-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-4-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/768-21-0x0000000000400000-0x0000000000728000-memory.dmp

        Filesize

        3.2MB

      • memory/1652-56-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/1652-55-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/1652-54-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/1864-1-0x0000000074AB0000-0x000000007505B000-memory.dmp

        Filesize

        5.7MB

      • memory/1864-17-0x0000000074AB0000-0x000000007505B000-memory.dmp

        Filesize

        5.7MB

      • memory/1864-0-0x0000000074AB1000-0x0000000074AB2000-memory.dmp

        Filesize

        4KB

      • memory/1864-2-0x0000000074AB0000-0x000000007505B000-memory.dmp

        Filesize

        5.7MB

      • memory/2616-19-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/2616-23-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2616-51-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/2616-22-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/2616-20-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/2616-18-0x0000000000400000-0x00000000004CA000-memory.dmp

        Filesize

        808KB

      • memory/2740-33-0x00000000743E1000-0x00000000743E2000-memory.dmp

        Filesize

        4KB

      • memory/2740-34-0x00000000743E0000-0x000000007498B000-memory.dmp

        Filesize

        5.7MB

      • memory/2740-38-0x00000000743E0000-0x000000007498B000-memory.dmp

        Filesize

        5.7MB

      • memory/2740-50-0x00000000743E0000-0x000000007498B000-memory.dmp

        Filesize

        5.7MB

      • memory/3048-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB