darkcomet | dc4a8fc218f79aea3d18b9326717d5a219c154a6aa6f3a4f7ef258023ebc0692

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe
Size

3.6MB
MD5

7d90f7a105098f45110f71e7c5acf0d1
SHA1

6ac34cb84ac377e813e52934f032f8e2132544f3
SHA256

dc4a8fc218f79aea3d18b9326717d5a219c154a6aa6f3a4f7ef258023ebc0692
SHA512

63f070dc31f9490920aedc1d6fdd2081d3e7861f2c0c22ed516d518976c1fd41b9d0b7a49895982fa3c6f84d06ed01881013d1395a09aae4b9e2aa600f3b2176
SSDEEP

49152:eG75ATl5Too3e8odvG7bAKusrx0UbFAcd:Z6Toh5dvG7gmHd

Score

10^/10

darkcomet rs4 discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

RS4

50123105510.no-ip.biz:20

Mutex

DC_MUTEX-AAE6Q5H

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Pf5AEXF4vBub
install
true
offline_keylogger
false
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
220	attrib.exe
928	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

Processes:

My Application.exeTASKMGR.EXEmsdcsc.exe

pid	Process
3856	My Application.exe
404	TASKMGR.EXE
512	msdcsc.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3092 set thread context of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87

Drops file in Windows directory 2 IoCs

Processes:

attrib.exeattrib.exe

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2616	404	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

My Application.execmd.execmd.exeattrib.exeattrib.exemsdcsc.exe7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exevbc.exeTASKMGR.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	My Application.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKMGR.EXE

Modifies registry class 1 IoCs

Processes:

vbc.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	vbc.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

vbc.exeTASKMGR.EXE

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3508	vbc.exe
Token: SeSecurityPrivilege	3508	vbc.exe
Token: SeTakeOwnershipPrivilege	3508	vbc.exe
Token: SeLoadDriverPrivilege	3508	vbc.exe
Token: SeSystemProfilePrivilege	3508	vbc.exe
Token: SeSystemtimePrivilege	3508	vbc.exe
Token: SeProfSingleProcessPrivilege	3508	vbc.exe
Token: SeIncBasePriorityPrivilege	3508	vbc.exe
Token: SeCreatePagefilePrivilege	3508	vbc.exe
Token: SeBackupPrivilege	3508	vbc.exe
Token: SeRestorePrivilege	3508	vbc.exe
Token: SeShutdownPrivilege	3508	vbc.exe
Token: SeDebugPrivilege	3508	vbc.exe
Token: SeSystemEnvironmentPrivilege	3508	vbc.exe
Token: SeChangeNotifyPrivilege	3508	vbc.exe
Token: SeRemoteShutdownPrivilege	3508	vbc.exe
Token: SeUndockPrivilege	3508	vbc.exe
Token: SeManageVolumePrivilege	3508	vbc.exe
Token: SeImpersonatePrivilege	3508	vbc.exe
Token: SeCreateGlobalPrivilege	3508	vbc.exe
Token: 33	3508	vbc.exe
Token: 34	3508	vbc.exe
Token: 35	3508	vbc.exe
Token: 36	3508	vbc.exe
Token: SeDebugPrivilege	404	TASKMGR.EXE

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exevbc.execmd.execmd.exe

description	pid	Process	procid_target
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3508	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	87
PID 3508 wrote to memory of 3424	3508	vbc.exe	88
PID 3508 wrote to memory of 3424	3508	vbc.exe	88
PID 3508 wrote to memory of 3424	3508	vbc.exe	88
PID 3092 wrote to memory of 3856	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	89
PID 3092 wrote to memory of 3856	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	89
PID 3092 wrote to memory of 3856	3092	7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe	89
PID 3508 wrote to memory of 664	3508	vbc.exe	91
PID 3508 wrote to memory of 664	3508	vbc.exe	91
PID 3508 wrote to memory of 664	3508	vbc.exe	91
PID 3508 wrote to memory of 404	3508	vbc.exe	93
PID 3508 wrote to memory of 404	3508	vbc.exe	93
PID 3508 wrote to memory of 404	3508	vbc.exe	93
PID 3424 wrote to memory of 220	3424	cmd.exe	94
PID 3424 wrote to memory of 220	3424	cmd.exe	94
PID 3424 wrote to memory of 220	3424	cmd.exe	94
PID 664 wrote to memory of 928	664	cmd.exe	95
PID 664 wrote to memory of 928	664	cmd.exe	95
PID 664 wrote to memory of 928	664	cmd.exe	95
PID 3508 wrote to memory of 512	3508	vbc.exe	96
PID 3508 wrote to memory of 512	3508	vbc.exe	96
PID 3508 wrote to memory of 512	3508	vbc.exe	96

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
220	attrib.exe
928	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7d90f7a105098f45110f71e7c5acf0d1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:928
- - C:\Users\Admin\AppData\Local\Temp\TASKMGR.EXE
    "C:\Users\Admin\AppData\Local\Temp\TASKMGR.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1516
      4⤵
      Program crash
      PID:2616
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:512
- C:\Users\Admin\AppData\Local\Temp\My Application.exe
  "C:\Users\Admin\AppData\Local\Temp\My Application.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 404 -ip 404
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\My Application.exe

Filesize
2.4MB

MD5
e031e5491425690d44aa78fd354369be

SHA1
476247963de5cb437a74b4e4998d7481300a6e4f

SHA256
fdbe83346b24ddb37c3d8ffb13c58e3249990f85afaf1bbf27cfcfb3096f095c

SHA512
f1d42d4a5ebb9983588922175b51f720988771239ab79566de32ae26cd649cfeee8085a11ea67a31aaebdee52ca17e54edb5f9c9e2ec3c4128da143747f0f373

Download Submit
C:\Users\Admin\AppData\Local\Temp\TASKMGR.EXE

Filesize
507KB

MD5
89d3827b3bf71a62537e026285407a70

SHA1
90fa59f8f1312b1dca2b0a03ee9c5ba20ad4df6f

SHA256
ecdfb702317472c6e9e6c91fbbdd0488a8024fdf215961c15d0cacd91258ada1

SHA512
73a664fd9fa45a0d2d9c13017e2c3e762beaad85544550849855494548ebf6e8d62a4fd942e2aa61f9d1cac043774153be1d32957d095ef3b7d286bc8bed2943

Download Submit
memory/404-35-0x0000000005710000-0x0000000005CB4000-memory.dmp

Filesize
5.6MB

Download
memory/404-34-0x0000000000D30000-0x0000000000DB6000-memory.dmp

Filesize
536KB

Download
memory/404-37-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/404-36-0x0000000005020000-0x00000000050BC000-memory.dmp

Filesize
624KB

Download
memory/3092-31-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-2-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-0-0x0000000074932000-0x0000000074933000-memory.dmp

Filesize
4KB

Download
memory/3092-1-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/3508-3-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3508-4-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3508-8-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3508-6-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3508-5-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3508-96-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download