darkcomet | a27a185b9f8e65db47817f2c4ac5c8085d4dba22abd9ca607aa7daf8553e7bff

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2025, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe
Size 777KB
Sample250124-cptctavkc1
SHA256 a27a185b9f8e65db47817f2c4ac5c8085d4dba22abd9ca607aa7daf8553e7bff
MD5 1d0f673ee9048a28c447e3adb83329c4
SHA1 46dad27b42272dd87fb89128695b6264c992a0d1
SHA512 9274285641e463b003464204a341cdf7864e6f475d86884392ec8ad46d13d8af2e2c555af5a3fe2239ce33066096ba61386cb5aad29cd9965dd8dc168ab72900
SSDEEP 12288:uEEXmw/aQ1PifJQ3j0DfAyhb5Nahsdg8iU8IpUixmdR:l8gfs0jpb5NaN8ioUiEdR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

myratherenow.no-ip.biz:3737

Mutex

DC_MUTEX-KUYD9J8

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
k6TJEpcoZLQU
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Stage1.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Crypted.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Stage1.exe

Executes dropped EXE 5 IoCs

pid	Process
2140	Crypted.exe
4904	fb.exe
3340	Stage2.exe
4532	Stage1.exe
2292	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Stage1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023cda-5.dat	upx
behavioral2/memory/2140-12-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/files/0x0007000000023ce2-29.dat	upx
behavioral2/memory/3340-36-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/3340-40-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/2140-56-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stage2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stage1.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4532	Stage1.exe
Token: SeSecurityPrivilege	4532	Stage1.exe
Token: SeTakeOwnershipPrivilege	4532	Stage1.exe
Token: SeLoadDriverPrivilege	4532	Stage1.exe
Token: SeSystemProfilePrivilege	4532	Stage1.exe
Token: SeSystemtimePrivilege	4532	Stage1.exe
Token: SeProfSingleProcessPrivilege	4532	Stage1.exe
Token: SeIncBasePriorityPrivilege	4532	Stage1.exe
Token: SeCreatePagefilePrivilege	4532	Stage1.exe
Token: SeBackupPrivilege	4532	Stage1.exe
Token: SeRestorePrivilege	4532	Stage1.exe
Token: SeShutdownPrivilege	4532	Stage1.exe
Token: SeDebugPrivilege	4532	Stage1.exe
Token: SeSystemEnvironmentPrivilege	4532	Stage1.exe
Token: SeChangeNotifyPrivilege	4532	Stage1.exe
Token: SeRemoteShutdownPrivilege	4532	Stage1.exe
Token: SeUndockPrivilege	4532	Stage1.exe
Token: SeManageVolumePrivilege	4532	Stage1.exe
Token: SeImpersonatePrivilege	4532	Stage1.exe
Token: SeCreateGlobalPrivilege	4532	Stage1.exe
Token: 33	4532	Stage1.exe
Token: 34	4532	Stage1.exe
Token: 35	4532	Stage1.exe
Token: 36	4532	Stage1.exe
Token: SeIncreaseQuotaPrivilege	2292	msdcsc.exe
Token: SeSecurityPrivilege	2292	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2292	msdcsc.exe
Token: SeLoadDriverPrivilege	2292	msdcsc.exe
Token: SeSystemProfilePrivilege	2292	msdcsc.exe
Token: SeSystemtimePrivilege	2292	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2292	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2292	msdcsc.exe
Token: SeCreatePagefilePrivilege	2292	msdcsc.exe
Token: SeBackupPrivilege	2292	msdcsc.exe
Token: SeRestorePrivilege	2292	msdcsc.exe
Token: SeShutdownPrivilege	2292	msdcsc.exe
Token: SeDebugPrivilege	2292	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2292	msdcsc.exe
Token: SeChangeNotifyPrivilege	2292	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2292	msdcsc.exe
Token: SeUndockPrivilege	2292	msdcsc.exe
Token: SeManageVolumePrivilege	2292	msdcsc.exe
Token: SeImpersonatePrivilege	2292	msdcsc.exe
Token: SeCreateGlobalPrivilege	2292	msdcsc.exe
Token: 33	2292	msdcsc.exe
Token: 34	2292	msdcsc.exe
Token: 35	2292	msdcsc.exe
Token: 36	2292	msdcsc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4904	fb.exe
2292	msdcsc.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2140	4860	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe	84
PID 4860 wrote to memory of 2140	4860	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe	84
PID 4860 wrote to memory of 2140	4860	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe	84
PID 4860 wrote to memory of 4904	4860	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe	85
PID 4860 wrote to memory of 4904	4860	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe	85
PID 4860 wrote to memory of 4904	4860	JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe	85
PID 2140 wrote to memory of 3340	2140	Crypted.exe	86
PID 2140 wrote to memory of 3340	2140	Crypted.exe	86
PID 2140 wrote to memory of 3340	2140	Crypted.exe	86
PID 2140 wrote to memory of 4532	2140	Crypted.exe	88
PID 2140 wrote to memory of 4532	2140	Crypted.exe	88
PID 2140 wrote to memory of 4532	2140	Crypted.exe	88
PID 4532 wrote to memory of 2292	4532	Stage1.exe	89
PID 4532 wrote to memory of 2292	4532	Stage1.exe	89
PID 4532 wrote to memory of 2292	4532	Stage1.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d0f673ee9048a28c447e3adb83329c4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\Crypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Stage2.exe
    "C:\Users\Admin\AppData\Local\Temp\Stage2.exe" x -y -oC:\Users\Admin\AppData\Local\Temp -pxnq8rPMxVI87ciGwWJHxRTy3iauHcIirteOOELv3B5vkS9kJoHBUAahY1dWxj8yA
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Stage1.exe
    "C:\Users\Admin\AppData\Local\Temp\Stage1.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2292
- C:\Users\Admin\AppData\Local\Temp\fb.exe
  "C:\Users\Admin\AppData\Local\Temp\fb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Crypted.exe

Path C:\Users\Admin\AppData\Local\Temp\Crypted.exe
Size 403KB
SHA256 8bce36e743256dc3edad5cb3109dda1e9a38b78e364d3392a47d55188ad24f6d
MD5 8f2e4ebabd4ca87f2a66862cd79baccc
SHA1 002235ff65498d6a5feda249feae1687499d837a
SHA512 92c8e35c032f2b6fe9bb076e0bd3333cb82e797cabcff9247cf497aadce5543432664097d58df7d9d967fc6ee2531214bd2aae1e558aca1d5092d6c7675135ba
SSDEEP 12288:slghoSqnNJ/Jj0HfAyhH5+ahsdB8im8IpcixmK0:Cg2nNb0/pH5+ai8iKciEK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Stage1.exe

Path C:\Users\Admin\AppData\Local\Temp\Stage1.exe
Size 658KB
SHA256 a568eb0e75ff7079e2c74dbe4e76875dcde39e3dd0c525365e977a017d3bb195
MD5 db4cf755c9998f2b054fcffbef6e354c
SHA1 328257469b45e1e20ffb06c197d999816c5b9f1e
SHA512 37b05dd0b98e1dfdefbc3ed907342d6478b37a7cf28bdd984ff555a14d43b932040f5a28e3b9fc7dea36ad16733257164a7dd94d66ed0fe3a65dca8f9b659e4b
SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hE:+Z1xuVVjfFoynPaVBUR8f+kN10EBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Stage2.exe

Path C:\Users\Admin\AppData\Local\Temp\Stage2.exe
Size 356KB
SHA256 a493e188cf3607497259725a297f810095b6f48154e820bfc83dc33cca518965
MD5 2340b72183d8e5b715cfe7eec0b934da
SHA1 c35424f0f9f0f8f7e0b991c021c1337c87c6d448
SHA512 cdd0e9fb63d880d8cc53adfe1fb011ab4d949c257d8cb7a25d96757d2e446126f015b7aab2fc50eec8377cc0b13167f49a1d9b6531e737af8aba967726156568
SSDEEP 6144:DqSRH/Ky5YTfDfjlhPcERHbU4bTx3hgxeEImQN4Zm7P5YtA618e2x:D9lf5wfDfvkERHvnIcmQNfj537eU
MD5 SHA1 SHA512 SSDEEP

Submit Download

fb.exe

Path C:\Users\Admin\AppData\Local\Temp\fb.exe
Size 16KB
SHA256 351b5f6759e396244e98dc5fbc2d86bd4a3066af3a7378b8073d2f07b25167d3
MD5 1df8f182b953de1f57dc102b7a04965c
SHA1 adbd3b9870c01b8938f14b669bd197e8e81233c4
SHA512 9e07fb58713e192ac1cbd0e5ac6d05f86ebf6a3f85c7cc6bfc751ad43faf06545f81a696e16be70802256eb5f7102ee34da4dc3a875a9fc6429f3a32b5b1b552
SSDEEP 96:/lxiXEZ+nmW2AmKmcg162M02SorXGT42:/TAmWW42MTi4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2140-12-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2140-56-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2292-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2292-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3340-36-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3340-40-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4532-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads