darkcomet | 0c3f46ae3fc505174a3b46dc142282a83d1d1f7c101dd325562bd52786385ce5

Analysis

max time kernel
119s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2025, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe
Size

887KB
MD5

09e6721400a9d479f103d682e0e9d4d1
SHA1

14045b8a3635dc696704ccf0e9e6114ac811605a
SHA256

0c3f46ae3fc505174a3b46dc142282a83d1d1f7c101dd325562bd52786385ce5
SHA512

2ec055eb9eed61a27b0d65d4b737ad261fbcd6c49baea300f23e93735d54c647ddb05d188694761c127c745518f4f2210ebe4441b5bbe84d12ecdbf28c33278f
SSDEEP

24576:D35J2CjGhO9uxFXP5E8DAzWAvGI+Zunfign:9YuJIAjgunf

Score

10^/10

darkcomet slave discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Slave

mo3u8se.no-ip.org:1604

Mutex

DC_MUTEX-WFTA49N

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
zwL8DMPpJ1QA
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe"	csc.exe

Executes dropped EXE 1 IoCs

pid	Process
324	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe"	csc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	csc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3832	csc.exe
Token: SeSecurityPrivilege	3832	csc.exe
Token: SeTakeOwnershipPrivilege	3832	csc.exe
Token: SeLoadDriverPrivilege	3832	csc.exe
Token: SeSystemProfilePrivilege	3832	csc.exe
Token: SeSystemtimePrivilege	3832	csc.exe
Token: SeProfSingleProcessPrivilege	3832	csc.exe
Token: SeIncBasePriorityPrivilege	3832	csc.exe
Token: SeCreatePagefilePrivilege	3832	csc.exe
Token: SeBackupPrivilege	3832	csc.exe
Token: SeRestorePrivilege	3832	csc.exe
Token: SeShutdownPrivilege	3832	csc.exe
Token: SeDebugPrivilege	3832	csc.exe
Token: SeSystemEnvironmentPrivilege	3832	csc.exe
Token: SeChangeNotifyPrivilege	3832	csc.exe
Token: SeRemoteShutdownPrivilege	3832	csc.exe
Token: SeUndockPrivilege	3832	csc.exe
Token: SeManageVolumePrivilege	3832	csc.exe
Token: SeImpersonatePrivilege	3832	csc.exe
Token: SeCreateGlobalPrivilege	3832	csc.exe
Token: 33	3832	csc.exe
Token: 34	3832	csc.exe
Token: 35	3832	csc.exe
Token: 36	3832	csc.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 2756 wrote to memory of 3832	2756	JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe	89
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 2836	3832	csc.exe	90
PID 3832 wrote to memory of 324	3832	csc.exe	91
PID 3832 wrote to memory of 324	3832	csc.exe	91
PID 3832 wrote to memory of 324	3832	csc.exe	91

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2836
- - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe

Filesize
78KB

MD5
2b9482eb5d3af71029277e18f6c656c0

SHA1
d594dc39c6e5f8fbd145d8970e096dc1d9b4a7f1

SHA256
1be7a63415f03400065f2beb2ca991c8b0b914bd41310cf9dd93c5e1fc0ed072

SHA512
46abaf2e57e498dd60352f76b484825eff7ebdd89cf512ba046d229d5d24a34e5f67c48a1d59551e0b49603a1ffee2ffbc124eef0042ddf3fe7fae423b4af0a8

Download Submit
memory/2756-0-0x0000000075412000-0x0000000075413000-memory.dmp

Filesize
4KB

Download
memory/2756-1-0x0000000075410000-0x00000000759C1000-memory.dmp

Filesize
5.7MB

Download
memory/2756-2-0x0000000075410000-0x00000000759C1000-memory.dmp

Filesize
5.7MB

Download
memory/2756-7-0x0000000075410000-0x00000000759C1000-memory.dmp

Filesize
5.7MB

Download
memory/2836-11-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/3832-3-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3832-4-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3832-6-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3832-8-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3832-12-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3832-71-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads