darkcomet | e1263cb3be07c995a401f0330cf9ed5c1ac312399a250a8415dd64ad465ddac0

Analysis

max time kernel
143s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe
Size

1.3MB
MD5

5799c36ef14b2d929c07091d02035afa
SHA1

067d24dc4551b16018eb331ed7c9825f7d53baf5
SHA256

e1263cb3be07c995a401f0330cf9ed5c1ac312399a250a8415dd64ad465ddac0
SHA512

5571a35c68936ced6d38162184fc2c36bc91671ddaf43cb6cb17c1176cb214cc9aaa671097b326d99112d13025ee486d6c3e978b5dfaba08480b10118b658937
SSDEEP

24576:qg4LWJQyPxbhsJg4LWJQyPxbhsNZ1xuVVjfFoynPaVBUR8f+kN10EB4:qg4LWJQihsJg4LWJQihsXQDgok30J

Score

10^/10

darkcomet vittoom discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

vittoom

46.185.199.66:120 �

Mutex

DC_MUTEX-YA8CEL4

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
QRzaFt0Etgit
install
true
offline_keylogger
true
persistence
true
reg_key
��

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

lolgg.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	lolgg.exe

Executes dropped EXE 3 IoCs

Processes:

Stub.exelolgg.exemsdcsc.exe

pid	Process
2716	Stub.exe
2756	lolgg.exe
2328	msdcsc.exe

Loads dropped DLL 2 IoCs

Processes:

lolgg.exe

pid	Process
2756	lolgg.exe
2756	lolgg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

lolgg.exemsdcsc.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ãíßÑæÈÏÇÊí = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	lolgg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ãíßÑæÈÏÇÊí = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

msdcsc.exelolgg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lolgg.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

lolgg.exemsdcsc.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2756	lolgg.exe
Token: SeSecurityPrivilege	2756	lolgg.exe
Token: SeTakeOwnershipPrivilege	2756	lolgg.exe
Token: SeLoadDriverPrivilege	2756	lolgg.exe
Token: SeSystemProfilePrivilege	2756	lolgg.exe
Token: SeSystemtimePrivilege	2756	lolgg.exe
Token: SeProfSingleProcessPrivilege	2756	lolgg.exe
Token: SeIncBasePriorityPrivilege	2756	lolgg.exe
Token: SeCreatePagefilePrivilege	2756	lolgg.exe
Token: SeBackupPrivilege	2756	lolgg.exe
Token: SeRestorePrivilege	2756	lolgg.exe
Token: SeShutdownPrivilege	2756	lolgg.exe
Token: SeDebugPrivilege	2756	lolgg.exe
Token: SeSystemEnvironmentPrivilege	2756	lolgg.exe
Token: SeChangeNotifyPrivilege	2756	lolgg.exe
Token: SeRemoteShutdownPrivilege	2756	lolgg.exe
Token: SeUndockPrivilege	2756	lolgg.exe
Token: SeManageVolumePrivilege	2756	lolgg.exe
Token: SeImpersonatePrivilege	2756	lolgg.exe
Token: SeCreateGlobalPrivilege	2756	lolgg.exe
Token: 33	2756	lolgg.exe
Token: 34	2756	lolgg.exe
Token: 35	2756	lolgg.exe
Token: SeIncreaseQuotaPrivilege	2328	msdcsc.exe
Token: SeSecurityPrivilege	2328	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2328	msdcsc.exe
Token: SeLoadDriverPrivilege	2328	msdcsc.exe
Token: SeSystemProfilePrivilege	2328	msdcsc.exe
Token: SeSystemtimePrivilege	2328	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2328	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2328	msdcsc.exe
Token: SeCreatePagefilePrivilege	2328	msdcsc.exe
Token: SeBackupPrivilege	2328	msdcsc.exe
Token: SeRestorePrivilege	2328	msdcsc.exe
Token: SeShutdownPrivilege	2328	msdcsc.exe
Token: SeDebugPrivilege	2328	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2328	msdcsc.exe
Token: SeChangeNotifyPrivilege	2328	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2328	msdcsc.exe
Token: SeUndockPrivilege	2328	msdcsc.exe
Token: SeManageVolumePrivilege	2328	msdcsc.exe
Token: SeImpersonatePrivilege	2328	msdcsc.exe
Token: SeCreateGlobalPrivilege	2328	msdcsc.exe
Token: 33	2328	msdcsc.exe
Token: 34	2328	msdcsc.exe
Token: 35	2328	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid	Process
2328	msdcsc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exelolgg.exe

description	pid	Process	procid_target
PID 3052 wrote to memory of 2716	3052	5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2716	3052	5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2716	3052	5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2756	3052	5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2756	3052	5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2756	3052	5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2756	3052	5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe	33
PID 2756 wrote to memory of 2328	2756	lolgg.exe	34
PID 2756 wrote to memory of 2328	2756	lolgg.exe	34
PID 2756 wrote to memory of 2328	2756	lolgg.exe	34
PID 2756 wrote to memory of 2328	2756	lolgg.exe	34

C:\Users\Admin\AppData\Local\Temp\5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5799c36ef14b2d929c07091d02035afa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\Stub.exe
  "C:\Users\Admin\AppData\Local\Temp\Stub.exe"
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\lolgg.exe
  "C:\Users\Admin\AppData\Local\Temp\lolgg.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Stub.exe

Filesize
313KB

MD5
413020ac7351cfffa1fbe7b71146f284

SHA1
7cb684d061bd44b79fecbeb0778e7de2c03284d2

SHA256
a0cb5c07288f0aa6175d42c664210f0f4c8d59182068fca76f9d8a0929015317

SHA512
ed4f3171761f23c1edfb71e33061a6b4437ef20d555300632a11b1c513701adecfa9688166ce1228d6f7799006ac08706854e75cfa1339dd60c6509587f4730f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lolgg.exe

Filesize
658KB

MD5
704dcb92d2e9b69151fe9b2f9a5839e4

SHA1
eea0487e80ad5a6d456b9167d6dccd2f108d1d1e

SHA256
16466b8c6a89e9185a751fc6d9e49be24484b703a88662e1af6cd7db08c429f6

SHA512
db5e0bebda5e46f751b8becffd9f8bc71c363736146ef0013242c43236183b5975bd6d3e24b3197e273004ca3943bc6eceac3d5d73a1aad1b0625817ce6e9f0b

Download Submit
memory/2328-29-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2328-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2328-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2756-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3052-0-0x000007FEF5A2E000-0x000007FEF5A2F000-memory.dmp

Filesize
4KB

Download
memory/3052-1-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-2-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-26-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download