darkcomet | 083880a74ce9330de51ef7e2b9f58bf767ba7b06d2b5b68434e3aab64a4d224e

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe
Size

716KB
MD5

5cef115e34325cb1889be7fae0f84648
SHA1

d3a78f0665a26ec0a9562d28cb6b74abcbe34e58
SHA256

083880a74ce9330de51ef7e2b9f58bf767ba7b06d2b5b68434e3aab64a4d224e
SHA512

28f76ddb01dd56900dcdf4161f228957108a58c9c99e47ac9d210d2a6e754ef8640ac7d2393a95d18a071ebf5d576b6a8a1813d7ba1a76e4ca86e820c23da00c
SSDEEP

12288:U0dwaaITkyLFaFtJsKzLyVPbXks/rA82zOwu5jcqtHhG7jfoaU/taRixB1aln+zH:XnTkyBaDCPbX/ySjrtujuhn12+99

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

95.79.31.101:1604

Mutex

DC_MUTEX-E2ZGDTS

Attributes

InstallPath
MSDCSC\svchost.exe
gencode
rW8pc78Q0Uk7
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\svchost.exe"	2929.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	2929.exe

Executes dropped EXE 3 IoCs

pid	Process
5008	2929.exe
1384	flooder.exe
400	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\svchost.exe"	2929.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2929.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5008	2929.exe
Token: SeSecurityPrivilege	5008	2929.exe
Token: SeTakeOwnershipPrivilege	5008	2929.exe
Token: SeLoadDriverPrivilege	5008	2929.exe
Token: SeSystemProfilePrivilege	5008	2929.exe
Token: SeSystemtimePrivilege	5008	2929.exe
Token: SeProfSingleProcessPrivilege	5008	2929.exe
Token: SeIncBasePriorityPrivilege	5008	2929.exe
Token: SeCreatePagefilePrivilege	5008	2929.exe
Token: SeBackupPrivilege	5008	2929.exe
Token: SeRestorePrivilege	5008	2929.exe
Token: SeShutdownPrivilege	5008	2929.exe
Token: SeDebugPrivilege	5008	2929.exe
Token: SeSystemEnvironmentPrivilege	5008	2929.exe
Token: SeChangeNotifyPrivilege	5008	2929.exe
Token: SeRemoteShutdownPrivilege	5008	2929.exe
Token: SeUndockPrivilege	5008	2929.exe
Token: SeManageVolumePrivilege	5008	2929.exe
Token: SeImpersonatePrivilege	5008	2929.exe
Token: SeCreateGlobalPrivilege	5008	2929.exe
Token: 33	5008	2929.exe
Token: 34	5008	2929.exe
Token: 35	5008	2929.exe
Token: 36	5008	2929.exe
Token: SeIncreaseQuotaPrivilege	400	svchost.exe
Token: SeSecurityPrivilege	400	svchost.exe
Token: SeTakeOwnershipPrivilege	400	svchost.exe
Token: SeLoadDriverPrivilege	400	svchost.exe
Token: SeSystemProfilePrivilege	400	svchost.exe
Token: SeSystemtimePrivilege	400	svchost.exe
Token: SeProfSingleProcessPrivilege	400	svchost.exe
Token: SeIncBasePriorityPrivilege	400	svchost.exe
Token: SeCreatePagefilePrivilege	400	svchost.exe
Token: SeBackupPrivilege	400	svchost.exe
Token: SeRestorePrivilege	400	svchost.exe
Token: SeShutdownPrivilege	400	svchost.exe
Token: SeDebugPrivilege	400	svchost.exe
Token: SeSystemEnvironmentPrivilege	400	svchost.exe
Token: SeChangeNotifyPrivilege	400	svchost.exe
Token: SeRemoteShutdownPrivilege	400	svchost.exe
Token: SeUndockPrivilege	400	svchost.exe
Token: SeManageVolumePrivilege	400	svchost.exe
Token: SeImpersonatePrivilege	400	svchost.exe
Token: SeCreateGlobalPrivilege	400	svchost.exe
Token: 33	400	svchost.exe
Token: 34	400	svchost.exe
Token: 35	400	svchost.exe
Token: 36	400	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
400	svchost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 5008	540	5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe	84
PID 540 wrote to memory of 5008	540	5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe	84
PID 540 wrote to memory of 5008	540	5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe	84
PID 540 wrote to memory of 1384	540	5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe	85
PID 540 wrote to memory of 1384	540	5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe	85
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 1792	5008	2929.exe	86
PID 5008 wrote to memory of 400	5008	2929.exe	90
PID 5008 wrote to memory of 400	5008	2929.exe	90
PID 5008 wrote to memory of 400	5008	2929.exe	90

C:\Users\Admin\AppData\Local\Temp\5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5cef115e34325cb1889be7fae0f84648_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\2929.exe
  "C:\Users\Admin\AppData\Local\Temp\2929.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1792
- - C:\Users\Admin\Documents\MSDCSC\svchost.exe
    "C:\Users\Admin\Documents\MSDCSC\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:400
- C:\Users\Admin\AppData\Local\Temp\flooder.exe
  "C:\Users\Admin\AppData\Local\Temp\flooder.exe"
  2⤵
  - Executes dropped EXE
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2929.exe

Filesize
690KB

MD5
1c1e287690221213a5a450e099a57c38

SHA1
3406b8d85028fdd610a656e8bcc792b918576456

SHA256
4c4f37f35696c74f98a3eb4231f520f03a1b7d797ff2ef3751ad411f722ef593

SHA512
0f669c05d7857fbd68fac19bab740dce81904d7c74531e96f7ddb2ba5fb1d648649cc284fcc03a62a08b47054a0c2e94391fe8bac0e5ec9c592eb441c40441c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\flooder.exe

Filesize
258KB

MD5
fc5f652289a2efd79f0bccb1656e664d

SHA1
bd8cf8572962a9bd70bd978b6bd7f3421f0e1df4

SHA256
6a5b078ab27b0e7e667c4d80ee8e9e3d85bb92021736762caef8919d5446d20a

SHA512
ac86cb254d0faf35e355013b7d483d580355ef3be4b4a454a8f53cdd0a64a3211b15775f63ed87a57155d4d4e68bd5f5ddd45193b9384b43bdcdab3737889e44

Download Submit
memory/400-93-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/400-95-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1384-24-0x00007FF897143000-0x00007FF897145000-memory.dmp

Filesize
8KB

Download
memory/1384-29-0x0000000000970000-0x00000000009B8000-memory.dmp

Filesize
288KB

Download
memory/1384-30-0x000000001B630000-0x000000001B640000-memory.dmp

Filesize
64KB

Download
memory/1384-31-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1384-80-0x0000000002930000-0x0000000002956000-memory.dmp

Filesize
152KB

Download
memory/1792-28-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/5008-25-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/5008-91-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads