darkcomet | 6545caa168c35ad901f0741c4f8cd34c37198f671b5a36fd71e30d4b42d412d3

Resubmissions

02-11-2024 16:06

241102-tj5x4ayene 10

02-11-2024 15:49

241102-s9eyxsyckd 10

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
Size

1.6MB
MD5

8640a191e4eacd387fb6d21147db6a70
SHA1

af9601ea153a88c6643762f18eff7725eacd5a2c
SHA256

6545caa168c35ad901f0741c4f8cd34c37198f671b5a36fd71e30d4b42d412d3
SHA512

2114d40700da138790e8cae3156fef11c8fc74832508618a6fb8c0e7f2b9b193090401dbf57748289732c639d7a96d64925fa803071d2c63942dcfb36960a1af
SSDEEP

24576:TaHMv6CorjqnyC88lDVSNM+pZpMaSQzflH/5VABj1gkV1bGFsYnqI8i:T1vqjdC8GD2oezfmRgmqqYnqIN

Score

10^/10

darkcomet guest16 discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

192.168.2.109:1604

87.168.62.25:1604

Mutex

DC_MUTEX-9AR1J0Z

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
q9dlJD4B3CF6
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

uncrypted.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	uncrypted.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2756 attrib.exe
2896 attrib.exe
Executes dropped EXE 2 IoCs

Processes:

uncrypted.exemsdcsc.exe

pid process

2560 uncrypted.exe
2764 msdcsc.exe

pid	process
2756	attrib.exe
2896	attrib.exe

pid	process
2560	uncrypted.exe
2764	msdcsc.exe

Loads dropped DLL 7 IoCs

Processes:

8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exeuncrypted.exe

pid	process
2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
2560	uncrypted.exe
2560	uncrypted.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

uncrypted.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	uncrypted.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2592-0-0x0000000000400000-0x000000000050C000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exeuncrypted.execmd.execmd.exeattrib.exemsdcsc.exeattrib.exenotepad.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uncrypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2764 msdcsc.exe

pid	process
2764	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

uncrypted.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2560	uncrypted.exe
Token: SeSecurityPrivilege	2560	uncrypted.exe
Token: SeTakeOwnershipPrivilege	2560	uncrypted.exe
Token: SeLoadDriverPrivilege	2560	uncrypted.exe
Token: SeSystemProfilePrivilege	2560	uncrypted.exe
Token: SeSystemtimePrivilege	2560	uncrypted.exe
Token: SeProfSingleProcessPrivilege	2560	uncrypted.exe
Token: SeIncBasePriorityPrivilege	2560	uncrypted.exe
Token: SeCreatePagefilePrivilege	2560	uncrypted.exe
Token: SeBackupPrivilege	2560	uncrypted.exe
Token: SeRestorePrivilege	2560	uncrypted.exe
Token: SeShutdownPrivilege	2560	uncrypted.exe
Token: SeDebugPrivilege	2560	uncrypted.exe
Token: SeSystemEnvironmentPrivilege	2560	uncrypted.exe
Token: SeChangeNotifyPrivilege	2560	uncrypted.exe
Token: SeRemoteShutdownPrivilege	2560	uncrypted.exe
Token: SeUndockPrivilege	2560	uncrypted.exe
Token: SeManageVolumePrivilege	2560	uncrypted.exe
Token: SeImpersonatePrivilege	2560	uncrypted.exe
Token: SeCreateGlobalPrivilege	2560	uncrypted.exe
Token: 33	2560	uncrypted.exe
Token: 34	2560	uncrypted.exe
Token: 35	2560	uncrypted.exe
Token: SeIncreaseQuotaPrivilege	2764	msdcsc.exe
Token: SeSecurityPrivilege	2764	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2764	msdcsc.exe
Token: SeLoadDriverPrivilege	2764	msdcsc.exe
Token: SeSystemProfilePrivilege	2764	msdcsc.exe
Token: SeSystemtimePrivilege	2764	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2764	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2764	msdcsc.exe
Token: SeCreatePagefilePrivilege	2764	msdcsc.exe
Token: SeBackupPrivilege	2764	msdcsc.exe
Token: SeRestorePrivilege	2764	msdcsc.exe
Token: SeShutdownPrivilege	2764	msdcsc.exe
Token: SeDebugPrivilege	2764	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2764	msdcsc.exe
Token: SeChangeNotifyPrivilege	2764	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2764	msdcsc.exe
Token: SeUndockPrivilege	2764	msdcsc.exe
Token: SeManageVolumePrivilege	2764	msdcsc.exe
Token: SeImpersonatePrivilege	2764	msdcsc.exe
Token: SeCreateGlobalPrivilege	2764	msdcsc.exe
Token: 33	2764	msdcsc.exe
Token: 34	2764	msdcsc.exe
Token: 35	2764	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2764 msdcsc.exe

pid	process
2764	msdcsc.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exeuncrypted.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 2592 wrote to memory of 2560	2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe	uncrypted.exe
PID 2592 wrote to memory of 2560	2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe	uncrypted.exe
PID 2592 wrote to memory of 2560	2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe	uncrypted.exe
PID 2592 wrote to memory of 2560	2592	8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe	uncrypted.exe
PID 2560 wrote to memory of 2844	2560	uncrypted.exe	cmd.exe
PID 2560 wrote to memory of 2844	2560	uncrypted.exe	cmd.exe
PID 2560 wrote to memory of 2844	2560	uncrypted.exe	cmd.exe
PID 2560 wrote to memory of 2844	2560	uncrypted.exe	cmd.exe
PID 2560 wrote to memory of 2860	2560	uncrypted.exe	cmd.exe
PID 2560 wrote to memory of 2860	2560	uncrypted.exe	cmd.exe
PID 2560 wrote to memory of 2860	2560	uncrypted.exe	cmd.exe
PID 2560 wrote to memory of 2860	2560	uncrypted.exe	cmd.exe
PID 2844 wrote to memory of 2756	2844	cmd.exe	attrib.exe
PID 2844 wrote to memory of 2756	2844	cmd.exe	attrib.exe
PID 2844 wrote to memory of 2756	2844	cmd.exe	attrib.exe
PID 2844 wrote to memory of 2756	2844	cmd.exe	attrib.exe
PID 2560 wrote to memory of 2764	2560	uncrypted.exe	msdcsc.exe
PID 2560 wrote to memory of 2764	2560	uncrypted.exe	msdcsc.exe
PID 2560 wrote to memory of 2764	2560	uncrypted.exe	msdcsc.exe
PID 2560 wrote to memory of 2764	2560	uncrypted.exe	msdcsc.exe
PID 2860 wrote to memory of 2896	2860	cmd.exe	attrib.exe
PID 2860 wrote to memory of 2896	2860	cmd.exe	attrib.exe
PID 2860 wrote to memory of 2896	2860	cmd.exe	attrib.exe
PID 2860 wrote to memory of 2896	2860	cmd.exe	attrib.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe
PID 2764 wrote to memory of 2980	2764	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2756 attrib.exe
2896 attrib.exe

pid	process
2756	attrib.exe
2896	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8640a191e4eacd387fb6d21147db6a70_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
  "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2896
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2764
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\crypt

Filesize
694KB

MD5
b7121490e9d5922d3833d649a342ace9

SHA1
e4c1fb6c75a2b40b6e417bff790fe61f6ddb9a5b

SHA256
8278cac693fabcc739e18dd0719a6fe8ffd87ab3a57ac0d80335bd7eb7443d51

SHA512
612d3e0ee41415939944509dc9c529dc9950dcad2d759b3b0a09774656e9e6af29979d3cc562a0b6ea88183cf100226e4a44f45717ec4aaa355c5362b5e9cccf

Download Submit
\Users\Admin\AppData\Local\Temp\uncrypted.exe

Filesize
694KB

MD5
66f0215ea35ecfa194a86246952781c1

SHA1
4693d299b0ae000338972a8dd724b0fd25b9401e

SHA256
1ba86da2445692d50bd20789bc9b962c58692319eb9935fae31dece7fb2d8ce2

SHA512
a444edb7217f7f160bf840b8dcd01cf66e18ffa95c3f6773de35f2f8cc3467977d308db2598853088ee0e72ad116cf31d5839c9f4605eab2a190484ac8b846a2

Download Submit
memory/2560-25-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2560-76-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2592-0-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/2764-77-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2764-79-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2764-81-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2764-89-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2980-37-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2980-75-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download