Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-08-2024 03:25

General

  • Target

    82dc3548b3bdb2f5ac595a7b10a686b5_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    82dc3548b3bdb2f5ac595a7b10a686b5

  • SHA1

    2fd25bcfb3440d3d9b55e20a6f272def0644fc9e

  • SHA256

    a594312bae733f5b364d85bbb4116a31d5a40617b1e1487a4f1243cc6e15375d

  • SHA512

    82fe8bca701a04baaf577f70aea7e0fdbf13af4ddbf1422c0a75bba06aaf0e4a9f651e0dc7752326b9a792f53c648a119156467d9b3d3c8c7f1c4d296be10f6d

  • SSDEEP

    24576:pNh+giDWlMUKfb3QUi1Cqn21DEEZ6yh0u:pn+giEMr8UXsQQEJX

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

yesyoa.no-ip.biz:1337

Mutex

DC_MUTEX-F54S21D

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    MlumXEwFRnE1

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82dc3548b3bdb2f5ac595a7b10a686b5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\82dc3548b3bdb2f5ac595a7b10a686b5_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Users\Admin\AppData\Local\Temp\82dc3548b3bdb2f5ac595a7b10a686b5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\82dc3548b3bdb2f5ac595a7b10a686b5_JaffaCakes118.exe
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:8804
      • C:\Users\Admin\AppData\Local\Temp\82dc3548b3bdb2f5ac595a7b10a686b5_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\82dc3548b3bdb2f5ac595a7b10a686b5_JaffaCakes118.exe
        3⤵
        • Modifies WinLogon for persistence
        • Checks computer location settings
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
          • Deletes itself
          • System Location Discovery: System Language Discovery
          PID:4812
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:9160
            • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
              C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:8552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

    Filesize

    1.1MB

    MD5

    82dc3548b3bdb2f5ac595a7b10a686b5

    SHA1

    2fd25bcfb3440d3d9b55e20a6f272def0644fc9e

    SHA256

    a594312bae733f5b364d85bbb4116a31d5a40617b1e1487a4f1243cc6e15375d

    SHA512

    82fe8bca701a04baaf577f70aea7e0fdbf13af4ddbf1422c0a75bba06aaf0e4a9f651e0dc7752326b9a792f53c648a119156467d9b3d3c8c7f1c4d296be10f6d

  • memory/3384-2822-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/3384-2887-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/3384-2823-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/3384-2819-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/3384-2820-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/3384-2821-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4812-2826-0x0000000000450000-0x0000000000451000-memory.dmp

    Filesize

    4KB

  • memory/8552-5709-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5721-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5726-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5725-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5724-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5723-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5722-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5720-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5719-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5712-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5711-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5710-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5718-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5715-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5716-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8552-5717-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/8804-2491-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/8804-2495-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/8804-2494-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/8804-2875-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/8804-2497-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/8804-2498-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/9160-5713-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/9160-5385-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/9160-5386-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB