darkcomet | 3a3a40e7ff8413fa854ebcfa806c49b8aca1e5229e9ac1d2b4328b7159656fac

General

Target

e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Size

662KB
MD5

e8fca18ed75c135fe91673d2aee177a0
SHA1

ba1eb6cae9eb724da4d025e5b11670e789a33544
SHA256

3a3a40e7ff8413fa854ebcfa806c49b8aca1e5229e9ac1d2b4328b7159656fac
SHA512

b555e3a99ab5cbe169d24c6b6c13268105d0f24c65b7e07c2d63e0a0dc8bf41ce200de41b4b223c2b805dba93716f3f57876a40b1289002c5965ec47293a834c
SSDEEP

12288:jk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+06:I0QRWoJEfg0oChGdJQbjPbNW5tYeP+GW

Score

10^/10

darkcomet guest16_min discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

127.0.0.1:1604

Mutex

DCMIN_MUTEX-VS89U65

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
WpWoCtQT9CWw
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\DCSCMIN\\IMDCSC.exe"	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

IMDCSC.exe

pid process

2328 IMDCSC.exe
Loads dropped DLL 2 IoCs

Processes:

e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

pid process

268 e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
268 e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

pid	process
2328	IMDCSC.exe

pid	process
268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\DCSCMIN\\IMDCSC.exe"	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exeIMDCSC.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exeIMDCSC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeSecurityPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeSystemtimePrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeBackupPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeRestorePrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeShutdownPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeDebugPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeUndockPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeManageVolumePrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeImpersonatePrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: 33	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: 34	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: 35	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2328	IMDCSC.exe
Token: SeSecurityPrivilege	2328	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	2328	IMDCSC.exe
Token: SeLoadDriverPrivilege	2328	IMDCSC.exe
Token: SeSystemProfilePrivilege	2328	IMDCSC.exe
Token: SeSystemtimePrivilege	2328	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	2328	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	2328	IMDCSC.exe
Token: SeCreatePagefilePrivilege	2328	IMDCSC.exe
Token: SeBackupPrivilege	2328	IMDCSC.exe
Token: SeRestorePrivilege	2328	IMDCSC.exe
Token: SeShutdownPrivilege	2328	IMDCSC.exe
Token: SeDebugPrivilege	2328	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	2328	IMDCSC.exe
Token: SeChangeNotifyPrivilege	2328	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	2328	IMDCSC.exe
Token: SeUndockPrivilege	2328	IMDCSC.exe
Token: SeManageVolumePrivilege	2328	IMDCSC.exe
Token: SeImpersonatePrivilege	2328	IMDCSC.exe
Token: SeCreateGlobalPrivilege	2328	IMDCSC.exe
Token: 33	2328	IMDCSC.exe
Token: 34	2328	IMDCSC.exe
Token: 35	2328	IMDCSC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IMDCSC.exe

pid process

2328 IMDCSC.exe

pid	process
2328	IMDCSC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe

description	pid	process	target process
PID 268 wrote to memory of 2328	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe	IMDCSC.exe
PID 268 wrote to memory of 2328	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe	IMDCSC.exe
PID 268 wrote to memory of 2328	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe	IMDCSC.exe
PID 268 wrote to memory of 2328	268	e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe	IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8fca18ed75c135fe91673d2aee177a0_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268
- C:\DCSCMIN\IMDCSC.exe
  "C:\DCSCMIN\IMDCSC.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\DCSCMIN\IMDCSC.exe

Filesize
662KB

MD5
e8fca18ed75c135fe91673d2aee177a0

SHA1
ba1eb6cae9eb724da4d025e5b11670e789a33544

SHA256
3a3a40e7ff8413fa854ebcfa806c49b8aca1e5229e9ac1d2b4328b7159656fac

SHA512
b555e3a99ab5cbe169d24c6b6c13268105d0f24c65b7e07c2d63e0a0dc8bf41ce200de41b4b223c2b805dba93716f3f57876a40b1289002c5965ec47293a834c

Download Submit
memory/268-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/268-10-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2328-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2328-13-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2328-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2328-17-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads