darkcomet | 09bb29e6a47c5eb92ee01c737f34cc2b2092ae6c6ddc1b6455fdf4754526ddcb

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe
Size

762KB
MD5

d5120831f470dfc446f0eb7f0828025d
SHA1

d5c87a9c79988ca71f1f59ecf8b063a886d36175
SHA256

09bb29e6a47c5eb92ee01c737f34cc2b2092ae6c6ddc1b6455fdf4754526ddcb
SHA512

7f4bd79b075d6cb0ef131dac443d29c93910cc069710628f24be5276f94c8e65a939ade9060d823b1a008cfc02da59afb6e40d120e524d1985b3aa38f1742493
SSDEEP

12288:s/fDmRvzHR/Dg3HycWvhAVfeBD8/D1nmcX6jgf+ESbMjgHSFSktyQe/rhhPl5WLG:YDmdzx/Dg3uZAVfeq/D3XXBSAjgHSnsz

Score

10^/10

darkcomet guest16 discovery evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

178.252.116.91:1604

Mutex

DC_MUTEX-MNKZPGM

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
8zGLDtrYqZZ2
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	darkcomettt.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2140	attrib.exe
3464	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	darkcomettt.exe

Executes dropped EXE 6 IoCs

pid	Process
2904	server.exe
2684	stealer.exe
540	darkcomettt.exe
1936	stealer.exe
2820	_xx_server.exe
2308	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	darkcomettt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	msdcsc.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023cbe-30.dat	upx
behavioral2/memory/540-34-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/540-53-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2308-113-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/540-116-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2308-117-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2308-119-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2308-121-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2308-123-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2308-125-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2308-129-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3088	2820	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	darkcomettt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_xx_server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	darkcomettt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2308	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	540	darkcomettt.exe
Token: SeSecurityPrivilege	540	darkcomettt.exe
Token: SeTakeOwnershipPrivilege	540	darkcomettt.exe
Token: SeLoadDriverPrivilege	540	darkcomettt.exe
Token: SeSystemProfilePrivilege	540	darkcomettt.exe
Token: SeSystemtimePrivilege	540	darkcomettt.exe
Token: SeProfSingleProcessPrivilege	540	darkcomettt.exe
Token: SeIncBasePriorityPrivilege	540	darkcomettt.exe
Token: SeCreatePagefilePrivilege	540	darkcomettt.exe
Token: SeBackupPrivilege	540	darkcomettt.exe
Token: SeRestorePrivilege	540	darkcomettt.exe
Token: SeShutdownPrivilege	540	darkcomettt.exe
Token: SeDebugPrivilege	540	darkcomettt.exe
Token: SeSystemEnvironmentPrivilege	540	darkcomettt.exe
Token: SeChangeNotifyPrivilege	540	darkcomettt.exe
Token: SeRemoteShutdownPrivilege	540	darkcomettt.exe
Token: SeUndockPrivilege	540	darkcomettt.exe
Token: SeManageVolumePrivilege	540	darkcomettt.exe
Token: SeImpersonatePrivilege	540	darkcomettt.exe
Token: SeCreateGlobalPrivilege	540	darkcomettt.exe
Token: 33	540	darkcomettt.exe
Token: 34	540	darkcomettt.exe
Token: 35	540	darkcomettt.exe
Token: 36	540	darkcomettt.exe
Token: SeIncreaseQuotaPrivilege	2308	msdcsc.exe
Token: SeSecurityPrivilege	2308	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2308	msdcsc.exe
Token: SeLoadDriverPrivilege	2308	msdcsc.exe
Token: SeSystemProfilePrivilege	2308	msdcsc.exe
Token: SeSystemtimePrivilege	2308	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2308	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2308	msdcsc.exe
Token: SeCreatePagefilePrivilege	2308	msdcsc.exe
Token: SeBackupPrivilege	2308	msdcsc.exe
Token: SeRestorePrivilege	2308	msdcsc.exe
Token: SeShutdownPrivilege	2308	msdcsc.exe
Token: SeDebugPrivilege	2308	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2308	msdcsc.exe
Token: SeChangeNotifyPrivilege	2308	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2308	msdcsc.exe
Token: SeUndockPrivilege	2308	msdcsc.exe
Token: SeManageVolumePrivilege	2308	msdcsc.exe
Token: SeImpersonatePrivilege	2308	msdcsc.exe
Token: SeCreateGlobalPrivilege	2308	msdcsc.exe
Token: 33	2308	msdcsc.exe
Token: 34	2308	msdcsc.exe
Token: 35	2308	msdcsc.exe
Token: 36	2308	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	msdcsc.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2904	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	83
PID 2588 wrote to memory of 2904	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	83
PID 2588 wrote to memory of 2904	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	83
PID 2588 wrote to memory of 2684	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	84
PID 2588 wrote to memory of 2684	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	84
PID 2588 wrote to memory of 2684	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	84
PID 2588 wrote to memory of 540	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	85
PID 2588 wrote to memory of 540	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	85
PID 2588 wrote to memory of 540	2588	d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe	85
PID 2684 wrote to memory of 1936	2684	stealer.exe	86
PID 2684 wrote to memory of 1936	2684	stealer.exe	86
PID 2684 wrote to memory of 1936	2684	stealer.exe	86
PID 2904 wrote to memory of 2820	2904	server.exe	87
PID 2904 wrote to memory of 2820	2904	server.exe	87
PID 2904 wrote to memory of 2820	2904	server.exe	87
PID 540 wrote to memory of 3316	540	darkcomettt.exe	99
PID 540 wrote to memory of 3316	540	darkcomettt.exe	99
PID 540 wrote to memory of 3316	540	darkcomettt.exe	99
PID 540 wrote to memory of 3428	540	darkcomettt.exe	100
PID 540 wrote to memory of 3428	540	darkcomettt.exe	100
PID 540 wrote to memory of 3428	540	darkcomettt.exe	100
PID 3316 wrote to memory of 2140	3316	cmd.exe	103
PID 3316 wrote to memory of 2140	3316	cmd.exe	103
PID 3316 wrote to memory of 2140	3316	cmd.exe	103
PID 3428 wrote to memory of 3464	3428	cmd.exe	104
PID 3428 wrote to memory of 3464	3428	cmd.exe	104
PID 3428 wrote to memory of 3464	3428	cmd.exe	104
PID 540 wrote to memory of 2308	540	darkcomettt.exe	105
PID 540 wrote to memory of 2308	540	darkcomettt.exe	105
PID 540 wrote to memory of 2308	540	darkcomettt.exe	105
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108
PID 2308 wrote to memory of 720	2308	msdcsc.exe	108

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2140	attrib.exe
3464	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d5120831f470dfc446f0eb7f0828025d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\_xx_server.exe
    "C:\Users\Admin\AppData\Local\_xx_server.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 720
      4⤵
      Program crash
      PID:3088
- C:\Users\Admin\AppData\Local\Temp\stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\stealer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Roaming\stealer.exe
    "C:\Users\Admin\AppData\Roaming\stealer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1936
- C:\Users\Admin\AppData\Local\Temp\darkcomettt.exe
  "C:\Users\Admin\AppData\Local\Temp\darkcomettt.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darkcomettt.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\darkcomettt.exe" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3464
- - C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
    "C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      System Location Discovery: System Language Discovery
      PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2820 -ip 2820
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\darkcomettt.exe

Filesize
252KB

MD5
10a32b9c47dab5a25ea12a3beffb17d0

SHA1
ab924fd6d76aa5ec325ac8d8ecac42b80d56fb91

SHA256
37cee6ae388f4eed1059fa76f43a143f7961be3c60e4cfc62ec737b16144a0c2

SHA512
f3565c48bafc041b23ec3e78767eb62a894037534296693be2928e7cc478234a7fe5eb88ec4b59a9d56f9c5f989e616ecf5967e02ffb8ae5a7c288e6836d3f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
669KB

MD5
a6ca67fa3012333e87e0fbfb4c297f17

SHA1
30c7be9d137b2d47a8e1427ac11c3bc0b74dbaf1

SHA256
e72764d1ed03901a09d29a17b2ccef09d8084af832b7023afa6caf52db0d9ec7

SHA512
3ce127adf4aafde5d8c4ece19cfc49e500ca1a574fdf468d2cb5409a0e2d733e9a73ef02f13dc163c359da6186d5f531e9bb4d021e504a5b7d8b30ec88059ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\stealer.exe

Filesize
24KB

MD5
700d01c4ae4b6f744aeab06505192eb5

SHA1
0fa45619d140b198beb6b3dc7eeaecf86a3e04c9

SHA256
dc4ac9c8cbea4f8095d5241f6242dabfe34ce0bab8da880f98d62c3b541b5ff8

SHA512
947846d7c64aa6f83bdfc31c9b0ec86f78a42f0d5a263a780438fcf51d533efd83d7c983c3642850f7bb1f0624489e371531f615b9d20a298fa6c353324c7ad2

Download Submit
memory/540-53-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/540-34-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/540-116-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/720-115-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1936-37-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1936-42-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2308-119-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2308-113-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2308-117-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2308-121-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2308-123-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2308-125-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2308-129-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2684-40-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2684-19-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2820-52-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2904-51-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads