darkcomet | e39de1c7ab9f83f0d8a3249d5a75e762506ca1664fc67a814dc027d98e7b5a10

Analysis

max time kernel
74s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Size

890KB
MD5

411649db01101f52a64d2d284c695977
SHA1

3babc81b202144a1239a7498443a6e4889435c1a
SHA256

e39de1c7ab9f83f0d8a3249d5a75e762506ca1664fc67a814dc027d98e7b5a10
SHA512

9219cc3bc8f85593f63864ebaf4f4d187bf26a4ed40ed8638e95b5b7103042322519cf0cd2a08301744e5365429ded9bd4d3514ce04b0b3f31564872a26d7203
SSDEEP

24576:vA1AmZr/OPo01OUAF7/cft/tz0tcv4xi2BrxfN:JMUm4nMxF

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

rorororo.no-ip.info:82

Mutex

DC_MUTEX-DZLR75C

Attributes

InstallPath
MSDCSC\msdcsc.scr
gencode
BtZqMQfJ82hc
install
true
offline_keylogger
true
password
1
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.scr"	411649db01101f52a64d2d284c695977_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2932	msdcsc.scr
2832	msdcsc.scr

Loads dropped DLL 2 IoCs

pid	Process
2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.scr"	411649db01101f52a64d2d284c695977_JaffaCakes118.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 2932 set thread context of 2832	2932	msdcsc.scr	32
PID 2832 set thread context of 264	2832	msdcsc.scr	33
PID 264 set thread context of 1192	264	iexplore.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.scr

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeSecurityPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeBackupPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeRestorePrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeShutdownPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeDebugPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeUndockPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: 33	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: 34	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: 35	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2832	msdcsc.scr
Token: SeSecurityPrivilege	2832	msdcsc.scr
Token: SeTakeOwnershipPrivilege	2832	msdcsc.scr
Token: SeLoadDriverPrivilege	2832	msdcsc.scr
Token: SeSystemProfilePrivilege	2832	msdcsc.scr
Token: SeSystemtimePrivilege	2832	msdcsc.scr
Token: SeProfSingleProcessPrivilege	2832	msdcsc.scr
Token: SeIncBasePriorityPrivilege	2832	msdcsc.scr
Token: SeCreatePagefilePrivilege	2832	msdcsc.scr
Token: SeBackupPrivilege	2832	msdcsc.scr
Token: SeRestorePrivilege	2832	msdcsc.scr
Token: SeShutdownPrivilege	2832	msdcsc.scr
Token: SeDebugPrivilege	2832	msdcsc.scr
Token: SeSystemEnvironmentPrivilege	2832	msdcsc.scr
Token: SeChangeNotifyPrivilege	2832	msdcsc.scr
Token: SeRemoteShutdownPrivilege	2832	msdcsc.scr
Token: SeUndockPrivilege	2832	msdcsc.scr
Token: SeManageVolumePrivilege	2832	msdcsc.scr
Token: SeImpersonatePrivilege	2832	msdcsc.scr
Token: SeCreateGlobalPrivilege	2832	msdcsc.scr
Token: 33	2832	msdcsc.scr
Token: 34	2832	msdcsc.scr
Token: 35	2832	msdcsc.scr

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2368	1688	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2932	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	31
PID 2368 wrote to memory of 2932	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	31
PID 2368 wrote to memory of 2932	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	31
PID 2368 wrote to memory of 2932	2368	411649db01101f52a64d2d284c695977_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2932 wrote to memory of 2832	2932	msdcsc.scr	32
PID 2832 wrote to memory of 264	2832	msdcsc.scr	33
PID 2832 wrote to memory of 264	2832	msdcsc.scr	33
PID 2832 wrote to memory of 264	2832	msdcsc.scr	33
PID 2832 wrote to memory of 264	2832	msdcsc.scr	33
PID 2832 wrote to memory of 264	2832	msdcsc.scr	33
PID 2832 wrote to memory of 264	2832	msdcsc.scr	33
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34
PID 264 wrote to memory of 1192	264	iexplore.exe	34

C:\Users\Admin\AppData\Local\Temp\411649db01101f52a64d2d284c695977_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\411649db01101f52a64d2d284c695977_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\411649db01101f52a64d2d284c695977_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\411649db01101f52a64d2d284c695977_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.scr
    "C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.scr" /S
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.scr
      C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.scr
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:264
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.scr

Filesize
890KB

MD5
411649db01101f52a64d2d284c695977

SHA1
3babc81b202144a1239a7498443a6e4889435c1a

SHA256
e39de1c7ab9f83f0d8a3249d5a75e762506ca1664fc67a814dc027d98e7b5a10

SHA512
9219cc3bc8f85593f63864ebaf4f4d187bf26a4ed40ed8638e95b5b7103042322519cf0cd2a08301744e5365429ded9bd4d3514ce04b0b3f31564872a26d7203

Download Submit
memory/264-77-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/1688-28-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2368-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2368-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-7-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-29-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-31-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2368-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2368-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2832-76-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2832-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2932-74-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads