darkcomet | cd480373893df19cf9d7fb3934de97f16cbfe54f00e0033bb824c6a306e376f9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Size

1.1MB
MD5

5b350b845f1fbffd58e7df32b2517e64
SHA1

267a66e9be811f1adae43558018500ed310e9e5b
SHA256

cd480373893df19cf9d7fb3934de97f16cbfe54f00e0033bb824c6a306e376f9
SHA512

81c8bba81e88e319b4a9eee7d503f58eb5956f326a0f1a80bec1c089f5c6b5d9144518dd64b09b4556efa4bf69535d4de01ffb3bb1b3b299e508e407803445c3
SSDEEP

24576:kRmJkcoQricOIQxiZY1iaJMGT60Di1Acz:hJZoQrbTFZY1iaaOPDu5

Score

10^/10

darkcomet guest16 discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

haaaak.no-ip.biz:1604

192.168.0.49:1604

78.193.120.61:1604

Mutex

DC_MUTEX-HSKBFE5

Attributes

InstallPath
MSDCSC\msdcscc.exe
gencode
zl6pN4PxD1MY
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcscc.exe"	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2248	msdcscc.exe
768	msdcscc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcscc.exe"	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe"	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msdcscc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcscc.exe"	msdcscc.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023ca8-18.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 4584	1556	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	85
PID 2248 set thread context of 768	2248	msdcscc.exe	89

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4584-8-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4584-9-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4584-10-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4584-11-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4584-12-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4584-13-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-40-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-41-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-43-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-42-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4584-44-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-46-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-49-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-51-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-53-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-55-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-57-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/768-59-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcscc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcscc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
768	msdcscc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSecurityPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeBackupPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeRestorePrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeShutdownPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeDebugPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeUndockPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: 33	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: 34	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: 35	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: 36	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	768	msdcscc.exe
Token: SeSecurityPrivilege	768	msdcscc.exe
Token: SeTakeOwnershipPrivilege	768	msdcscc.exe
Token: SeLoadDriverPrivilege	768	msdcscc.exe
Token: SeSystemProfilePrivilege	768	msdcscc.exe
Token: SeSystemtimePrivilege	768	msdcscc.exe
Token: SeProfSingleProcessPrivilege	768	msdcscc.exe
Token: SeIncBasePriorityPrivilege	768	msdcscc.exe
Token: SeCreatePagefilePrivilege	768	msdcscc.exe
Token: SeBackupPrivilege	768	msdcscc.exe
Token: SeRestorePrivilege	768	msdcscc.exe
Token: SeShutdownPrivilege	768	msdcscc.exe
Token: SeDebugPrivilege	768	msdcscc.exe
Token: SeSystemEnvironmentPrivilege	768	msdcscc.exe
Token: SeChangeNotifyPrivilege	768	msdcscc.exe
Token: SeRemoteShutdownPrivilege	768	msdcscc.exe
Token: SeUndockPrivilege	768	msdcscc.exe
Token: SeManageVolumePrivilege	768	msdcscc.exe
Token: SeImpersonatePrivilege	768	msdcscc.exe
Token: SeCreateGlobalPrivilege	768	msdcscc.exe
Token: 33	768	msdcscc.exe
Token: 34	768	msdcscc.exe
Token: 35	768	msdcscc.exe
Token: 36	768	msdcscc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
768	msdcscc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4584	1556	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	85
PID 1556 wrote to memory of 4584	1556	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	85
PID 1556 wrote to memory of 4584	1556	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	85
PID 1556 wrote to memory of 4584	1556	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	85
PID 1556 wrote to memory of 4584	1556	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	85
PID 4584 wrote to memory of 2248	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	88
PID 4584 wrote to memory of 2248	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	88
PID 4584 wrote to memory of 2248	4584	5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe	88
PID 2248 wrote to memory of 768	2248	msdcscc.exe	89
PID 2248 wrote to memory of 768	2248	msdcscc.exe	89
PID 2248 wrote to memory of 768	2248	msdcscc.exe	89
PID 2248 wrote to memory of 768	2248	msdcscc.exe	89
PID 2248 wrote to memory of 768	2248	msdcscc.exe	89

C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5b350b845f1fbffd58e7df32b2517e64_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe
      C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcscc.exe

Filesize
1.1MB

MD5
5b350b845f1fbffd58e7df32b2517e64

SHA1
267a66e9be811f1adae43558018500ed310e9e5b

SHA256
cd480373893df19cf9d7fb3934de97f16cbfe54f00e0033bb824c6a306e376f9

SHA512
81c8bba81e88e319b4a9eee7d503f58eb5956f326a0f1a80bec1c089f5c6b5d9144518dd64b09b4556efa4bf69535d4de01ffb3bb1b3b299e508e407803445c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\autA8A4.tmp

Filesize
251KB

MD5
ac25a9fd31f2f6a19020587abed1cd97

SHA1
ea75ab36916d63a9a591991337ccfb2038de4818

SHA256
cd5fb9e36331a602a664599ec68f1ad2c6d14aefbb232c0cb0a64dfa6a61d67a

SHA512
a898e30f5a5353dbc498a5e5e7a1b21b42302c072bcdc5c6cae1cf5bf5fe7c8023be1b8c7a85cc4e9f9f08d42926c1a80dca085342e8447b68b5c5152df998f4

Download Submit
memory/768-51-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-46-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-59-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-57-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-53-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-40-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-41-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-43-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-42-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/768-49-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4584-9-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4584-44-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4584-8-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4584-10-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4584-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4584-12-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4584-11-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads