darkcomet | 26123cba2a560a904c2729659a41ccc6be8c827d49bee85d325ae7c642e75dbf

Analysis

max time kernel
141s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Size

345KB
MD5

edd0bf306c18d503bac24b08d265ce4c
SHA1

0f93d0f8ec3146a625de3edc19c6947bafe37290
SHA256

26123cba2a560a904c2729659a41ccc6be8c827d49bee85d325ae7c642e75dbf
SHA512

b5be2e4e0403c6b23ef2d1fe89e4092b13b7911d932cf325f7eb5296451272c58e59c49cfacf0133325024a140c9d67131e77385a32541380709f5951f3c478f
SSDEEP

6144:NcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37ugxcis2yroB+j:NcW7KEZlPzCy377ZYj

Score

10^/10

darkcomet guest16 discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

192.168.178.36:1604

Mutex

DC_MUTEX-AZN8DW5

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
TGSJa1sEAuZp
install
true
offline_keylogger
false
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2320	notepad.exe

Executes dropped EXE 1 IoCs

pid	Process
2184	msdcsc.exe

Loads dropped DLL 2 IoCs

pid	Process
2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/files/0x0008000000016da7-41.dat	upx
behavioral1/memory/2184-42-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/2936-39-0x0000000003EF0000-0x0000000003FBF000-memory.dmp	upx
behavioral1/memory/2936-56-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/2184-58-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/2184-60-0x0000000000400000-0x00000000004CF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeSecurityPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeBackupPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeRestorePrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeShutdownPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeDebugPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeUndockPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: 33	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: 34	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: 35	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2184	msdcsc.exe
Token: SeSecurityPrivilege	2184	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2184	msdcsc.exe
Token: SeLoadDriverPrivilege	2184	msdcsc.exe
Token: SeSystemProfilePrivilege	2184	msdcsc.exe
Token: SeSystemtimePrivilege	2184	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2184	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2184	msdcsc.exe
Token: SeCreatePagefilePrivilege	2184	msdcsc.exe
Token: SeBackupPrivilege	2184	msdcsc.exe
Token: SeRestorePrivilege	2184	msdcsc.exe
Token: SeShutdownPrivilege	2184	msdcsc.exe
Token: SeDebugPrivilege	2184	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2184	msdcsc.exe
Token: SeChangeNotifyPrivilege	2184	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2184	msdcsc.exe
Token: SeUndockPrivilege	2184	msdcsc.exe
Token: SeManageVolumePrivilege	2184	msdcsc.exe
Token: SeImpersonatePrivilege	2184	msdcsc.exe
Token: SeCreateGlobalPrivilege	2184	msdcsc.exe
Token: 33	2184	msdcsc.exe
Token: 34	2184	msdcsc.exe
Token: 35	2184	msdcsc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2320	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2184	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2184	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2184	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2184	2936	edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edd0bf306c18d503bac24b08d265ce4c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2320
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
f643b01e0b72e0c717bfc0ad59fd0c55

SHA1
c3bf665b639a5f81d31488d42a8046b9d3849c00

SHA256
4cf54315332a2e8ee82de12b2b0d16c2fe93412b5d82246d6715e79a0e2f0aed

SHA512
f3bca29e19e351e8c8e7738480ef79505e9352c3ded15964f1f87de64f5d54ea5e369c42e5e5f4bd2a83c602bdb844a5cd0ef37ec8f74f1ee73a27cf9fa8a8e4

Download Submit
C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
a21d11c2903647cea906e037c3035cbf

SHA1
b9cb12faf5d6e92459f12dfcdd2be75c97c3b174

SHA256
6ae6c0cea5d66cfaf8d2e7537e16fafa14cd5ef5deb678973f890598fa3f7544

SHA512
5786a4d3e73dd4a6285fb30900e7c8961f3c860736d297a99a471b2d0e3ce05320ab3cfc6b869980bba17f315995ce7755a8910d26d03cb9df7bc4aeb757d16c

Download Submit
C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
444128df47403a91ea3034ecef1e5456

SHA1
23114f64f3530d6ea50628b40a1ad477568e5fce

SHA256
3f4e12f8d75beb067b7d24f4e531a2d5770c6ed97b3b8e3f77e11ffd27556297

SHA512
8ba7631f2cb2133e9eba3f6675b6634fe8d9909ffb9a02120caf69bc58677e26e241fe76613a9a3ecce402c569db25e7dc8f058ce708fb59d123b594063b8a1c

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
345KB

MD5
edd0bf306c18d503bac24b08d265ce4c

SHA1
0f93d0f8ec3146a625de3edc19c6947bafe37290

SHA256
26123cba2a560a904c2729659a41ccc6be8c827d49bee85d325ae7c642e75dbf

SHA512
b5be2e4e0403c6b23ef2d1fe89e4092b13b7911d932cf325f7eb5296451272c58e59c49cfacf0133325024a140c9d67131e77385a32541380709f5951f3c478f

Download Submit
memory/2184-42-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2184-58-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2184-60-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2320-31-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2320-16-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2936-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2936-40-0x0000000003EF0000-0x0000000003FBF000-memory.dmp

Filesize
828KB

Download
memory/2936-39-0x0000000003EF0000-0x0000000003FBF000-memory.dmp

Filesize
828KB

Download
memory/2936-12-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2936-56-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads