darkcomet | cd480373893df19cf9d7fb3934de97f16cbfe54f00e0033bb824c6a306e376f9

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/10/2024, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Size

1.1MB
MD5

5b350b845f1fbffd58e7df32b2517e64
SHA1

267a66e9be811f1adae43558018500ed310e9e5b
SHA256

cd480373893df19cf9d7fb3934de97f16cbfe54f00e0033bb824c6a306e376f9
SHA512

81c8bba81e88e319b4a9eee7d503f58eb5956f326a0f1a80bec1c089f5c6b5d9144518dd64b09b4556efa4bf69535d4de01ffb3bb1b3b299e508e407803445c3
SSDEEP

24576:kRmJkcoQricOIQxiZY1iaJMGT60Di1Acz:hJZoQrbTFZY1iaaOPDu5

Score

10^/10

darkcomet guest16 discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

haaaak.no-ip.biz:1604

192.168.0.49:1604

78.193.120.61:1604

Mutex

DC_MUTEX-HSKBFE5

Attributes

InstallPath
MSDCSC\msdcscc.exe
gencode
zl6pN4PxD1MY
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcscc.exe"	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2816	msdcscc.exe
2852	msdcscc.exe

Loads dropped DLL 2 IoCs

pid	Process
2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
2816	msdcscc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcscc.exe"	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe"	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msdcscc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcscc.exe"	msdcscc.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000700000001922c-23.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 2368	1900	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	30
PID 2816 set thread context of 2852	2816	msdcscc.exe	33

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-11-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2368-12-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2368-13-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2368-15-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2368-14-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2368-16-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-43-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-46-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-44-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-45-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2368-47-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-49-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-52-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-54-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-58-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-60-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2852-62-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcscc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcscc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	msdcscc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSecurityPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeBackupPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeRestorePrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeShutdownPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeDebugPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeUndockPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: 33	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: 34	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: 35	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2852	msdcscc.exe
Token: SeSecurityPrivilege	2852	msdcscc.exe
Token: SeTakeOwnershipPrivilege	2852	msdcscc.exe
Token: SeLoadDriverPrivilege	2852	msdcscc.exe
Token: SeSystemProfilePrivilege	2852	msdcscc.exe
Token: SeSystemtimePrivilege	2852	msdcscc.exe
Token: SeProfSingleProcessPrivilege	2852	msdcscc.exe
Token: SeIncBasePriorityPrivilege	2852	msdcscc.exe
Token: SeCreatePagefilePrivilege	2852	msdcscc.exe
Token: SeBackupPrivilege	2852	msdcscc.exe
Token: SeRestorePrivilege	2852	msdcscc.exe
Token: SeShutdownPrivilege	2852	msdcscc.exe
Token: SeDebugPrivilege	2852	msdcscc.exe
Token: SeSystemEnvironmentPrivilege	2852	msdcscc.exe
Token: SeChangeNotifyPrivilege	2852	msdcscc.exe
Token: SeRemoteShutdownPrivilege	2852	msdcscc.exe
Token: SeUndockPrivilege	2852	msdcscc.exe
Token: SeManageVolumePrivilege	2852	msdcscc.exe
Token: SeImpersonatePrivilege	2852	msdcscc.exe
Token: SeCreateGlobalPrivilege	2852	msdcscc.exe
Token: 33	2852	msdcscc.exe
Token: 34	2852	msdcscc.exe
Token: 35	2852	msdcscc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2852	msdcscc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2368	1900	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2368	1900	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2368	1900	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2368	1900	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2368	1900	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2368	1900	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2816	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	32
PID 2368 wrote to memory of 2816	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	32
PID 2368 wrote to memory of 2816	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	32
PID 2368 wrote to memory of 2816	2368	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	32
PID 2816 wrote to memory of 2852	2816	msdcscc.exe	33
PID 2816 wrote to memory of 2852	2816	msdcscc.exe	33
PID 2816 wrote to memory of 2852	2816	msdcscc.exe	33
PID 2816 wrote to memory of 2852	2816	msdcscc.exe	33
PID 2816 wrote to memory of 2852	2816	msdcscc.exe	33
PID 2816 wrote to memory of 2852	2816	msdcscc.exe	33

C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe
      C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe

Filesize
1.1MB

MD5
5b350b845f1fbffd58e7df32b2517e64

SHA1
267a66e9be811f1adae43558018500ed310e9e5b

SHA256
cd480373893df19cf9d7fb3934de97f16cbfe54f00e0033bb824c6a306e376f9

SHA512
81c8bba81e88e319b4a9eee7d503f58eb5956f326a0f1a80bec1c089f5c6b5d9144518dd64b09b4556efa4bf69535d4de01ffb3bb1b3b299e508e407803445c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ampere2.dat

Filesize
251KB

MD5
ac25a9fd31f2f6a19020587abed1cd97

SHA1
ea75ab36916d63a9a591991337ccfb2038de4818

SHA256
cd5fb9e36331a602a664599ec68f1ad2c6d14aefbb232c0cb0a64dfa6a61d67a

SHA512
a898e30f5a5353dbc498a5e5e7a1b21b42302c072bcdc5c6cae1cf5bf5fe7c8023be1b8c7a85cc4e9f9f08d42926c1a80dca085342e8447b68b5c5152df998f4

Download Submit
memory/2368-47-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2368-7-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2368-11-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2368-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2368-12-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2368-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2368-15-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2368-14-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2368-16-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-43-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-44-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-45-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-46-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-49-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-52-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-54-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-58-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-60-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2852-62-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads