darkcomet | dc4a8fc218f79aea3d18b9326717d5a219c154a6aa6f3a4f7ef258023ebc0692

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-10-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe
Size

3.6MB
MD5

7d90f7a105098f45110f71e7c5acf0d1
SHA1

6ac34cb84ac377e813e52934f032f8e2132544f3
SHA256

dc4a8fc218f79aea3d18b9326717d5a219c154a6aa6f3a4f7ef258023ebc0692
SHA512

63f070dc31f9490920aedc1d6fdd2081d3e7861f2c0c22ed516d518976c1fd41b9d0b7a49895982fa3c6f84d06ed01881013d1395a09aae4b9e2aa600f3b2176
SSDEEP

49152:eG75ATl5Too3e8odvG7bAKusrx0UbFAcd:Z6Toh5dvG7gmHd

Score

10^/10

darkcomet rs4 discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

RS4

50123105510.no-ip.biz:20

Mutex

DC_MUTEX-AAE6Q5H

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Pf5AEXF4vBub
install
true
offline_keylogger
false
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2740	attrib.exe
2572	attrib.exe

Executes dropped EXE 3 IoCs

Processes:

My Application.exeTASKMGR.EXEmsdcsc.exe

pid	Process
2748	My Application.exe
1600	TASKMGR.EXE
3000	msdcsc.exe

Loads dropped DLL 8 IoCs

Processes:

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exevbc.exeWerFault.exe

pid	Process
2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe
2340	vbc.exe
2340	vbc.exe
276	WerFault.exe
276	WerFault.exe
276	WerFault.exe
276	WerFault.exe
276	WerFault.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2332 set thread context of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31

Drops file in Windows directory 2 IoCs

Processes:

attrib.exeattrib.exe

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
276	1600	WerFault.exe	39

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

attrib.exemsdcsc.exe7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exeMy Application.execmd.exeattrib.exeTASKMGR.EXEvbc.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	My Application.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKMGR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vbc.exeTASKMGR.EXE

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2340	vbc.exe
Token: SeSecurityPrivilege	2340	vbc.exe
Token: SeTakeOwnershipPrivilege	2340	vbc.exe
Token: SeLoadDriverPrivilege	2340	vbc.exe
Token: SeSystemProfilePrivilege	2340	vbc.exe
Token: SeSystemtimePrivilege	2340	vbc.exe
Token: SeProfSingleProcessPrivilege	2340	vbc.exe
Token: SeIncBasePriorityPrivilege	2340	vbc.exe
Token: SeCreatePagefilePrivilege	2340	vbc.exe
Token: SeBackupPrivilege	2340	vbc.exe
Token: SeRestorePrivilege	2340	vbc.exe
Token: SeShutdownPrivilege	2340	vbc.exe
Token: SeDebugPrivilege	2340	vbc.exe
Token: SeSystemEnvironmentPrivilege	2340	vbc.exe
Token: SeChangeNotifyPrivilege	2340	vbc.exe
Token: SeRemoteShutdownPrivilege	2340	vbc.exe
Token: SeUndockPrivilege	2340	vbc.exe
Token: SeManageVolumePrivilege	2340	vbc.exe
Token: SeImpersonatePrivilege	2340	vbc.exe
Token: SeCreateGlobalPrivilege	2340	vbc.exe
Token: 33	2340	vbc.exe
Token: 34	2340	vbc.exe
Token: 35	2340	vbc.exe
Token: SeDebugPrivilege	1600	TASKMGR.EXE

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exevbc.execmd.execmd.exeTASKMGR.EXE

description	pid	Process	procid_target
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2340	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2748	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	32
PID 2332 wrote to memory of 2748	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	32
PID 2332 wrote to memory of 2748	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	32
PID 2332 wrote to memory of 2748	2332	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2924	2340	vbc.exe	33
PID 2340 wrote to memory of 2924	2340	vbc.exe	33
PID 2340 wrote to memory of 2924	2340	vbc.exe	33
PID 2340 wrote to memory of 2924	2340	vbc.exe	33
PID 2340 wrote to memory of 2716	2340	vbc.exe	34
PID 2340 wrote to memory of 2716	2340	vbc.exe	34
PID 2340 wrote to memory of 2716	2340	vbc.exe	34
PID 2340 wrote to memory of 2716	2340	vbc.exe	34
PID 2716 wrote to memory of 2572	2716	cmd.exe	37
PID 2716 wrote to memory of 2572	2716	cmd.exe	37
PID 2716 wrote to memory of 2572	2716	cmd.exe	37
PID 2716 wrote to memory of 2572	2716	cmd.exe	37
PID 2924 wrote to memory of 2740	2924	cmd.exe	38
PID 2924 wrote to memory of 2740	2924	cmd.exe	38
PID 2924 wrote to memory of 2740	2924	cmd.exe	38
PID 2924 wrote to memory of 2740	2924	cmd.exe	38
PID 2340 wrote to memory of 1600	2340	vbc.exe	39
PID 2340 wrote to memory of 1600	2340	vbc.exe	39
PID 2340 wrote to memory of 1600	2340	vbc.exe	39
PID 2340 wrote to memory of 1600	2340	vbc.exe	39
PID 2340 wrote to memory of 3000	2340	vbc.exe	40
PID 2340 wrote to memory of 3000	2340	vbc.exe	40
PID 2340 wrote to memory of 3000	2340	vbc.exe	40
PID 2340 wrote to memory of 3000	2340	vbc.exe	40
PID 1600 wrote to memory of 276	1600	TASKMGR.EXE	42
PID 1600 wrote to memory of 276	1600	TASKMGR.EXE	42
PID 1600 wrote to memory of 276	1600	TASKMGR.EXE	42
PID 1600 wrote to memory of 276	1600	TASKMGR.EXE	42

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2740	attrib.exe
2572	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2572
- - C:\Users\Admin\AppData\Local\Temp\TASKMGR.EXE
    "C:\Users\Admin\AppData\Local\Temp\TASKMGR.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 1056
      4⤵
      Loads dropped DLL
      Program crash
      PID:276
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3000
- C:\Users\Admin\AppData\Local\Temp\My Application.exe
  "C:\Users\Admin\AppData\Local\Temp\My Application.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\My Application.exe

Filesize
2.4MB

MD5
e031e5491425690d44aa78fd354369be

SHA1
476247963de5cb437a74b4e4998d7481300a6e4f

SHA256
fdbe83346b24ddb37c3d8ffb13c58e3249990f85afaf1bbf27cfcfb3096f095c

SHA512
f1d42d4a5ebb9983588922175b51f720988771239ab79566de32ae26cd649cfeee8085a11ea67a31aaebdee52ca17e54edb5f9c9e2ec3c4128da143747f0f373

Download Submit
\Users\Admin\AppData\Local\Temp\TASKMGR.EXE

Filesize
507KB

MD5
89d3827b3bf71a62537e026285407a70

SHA1
90fa59f8f1312b1dca2b0a03ee9c5ba20ad4df6f

SHA256
ecdfb702317472c6e9e6c91fbbdd0488a8024fdf215961c15d0cacd91258ada1

SHA512
73a664fd9fa45a0d2d9c13017e2c3e762beaad85544550849855494548ebf6e8d62a4fd942e2aa61f9d1cac043774153be1d32957d095ef3b7d286bc8bed2943

Download Submit
memory/1600-34-0x0000000000960000-0x00000000009E6000-memory.dmp

Filesize
536KB

Download
memory/2332-1-0x0000000074F20000-0x00000000754CB000-memory.dmp

Filesize
5.7MB

Download
memory/2332-2-0x0000000074F20000-0x00000000754CB000-memory.dmp

Filesize
5.7MB

Download
memory/2332-24-0x0000000074F20000-0x00000000754CB000-memory.dmp

Filesize
5.7MB

Download
memory/2332-0-0x0000000074F21000-0x0000000074F22000-memory.dmp

Filesize
4KB

Download
memory/2340-23-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2340-7-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2340-17-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-10-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-9-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-15-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-11-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-6-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-5-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-14-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-8-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-3-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2340-41-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download