darkcomet | ae3507004a75fcdd9a75b8453ef276328cf089476ce0d840c027feaf0056f13d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/03/2025, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe
Size

1.4MB
MD5

374e6afe24154e3613673122861ce0cf
SHA1

2cfd69c9bb0f9f20ebe971c1dfe909fb11601a75
SHA256

ae3507004a75fcdd9a75b8453ef276328cf089476ce0d840c027feaf0056f13d
SHA512

b887235ab7852a5f4073b67fe5b89034c0741cf87dfe4541caf3974a0322e9c0784010a86d2e8eedaad73cf058b2f8d11be5f212730b4ff388613d13d9ef81ae
SSDEEP

24576:+R3lQvH82TNdxtlF2jx1JT7ySLrJ7BcBBTXjYkhFH5tMdzFpLgitgN:8lQvH3dozB7ySPryTTnFHPED1g

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:200

michaelmichael.myftp.org:200

Mutex

DC_MUTEX-L8WW51F

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
WcQCytYXn2FT
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	vbc.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	639624.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	639624.exe

Executes dropped EXE 2 IoCs

pid	Process
2604	msdcsc.exe
1552	639624.exe

Loads dropped DLL 3 IoCs

pid	Process
2988	vbc.exe
2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe
2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2700 set thread context of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	639624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2988	vbc.exe
Token: SeSecurityPrivilege	2988	vbc.exe
Token: SeTakeOwnershipPrivilege	2988	vbc.exe
Token: SeLoadDriverPrivilege	2988	vbc.exe
Token: SeSystemProfilePrivilege	2988	vbc.exe
Token: SeSystemtimePrivilege	2988	vbc.exe
Token: SeProfSingleProcessPrivilege	2988	vbc.exe
Token: SeIncBasePriorityPrivilege	2988	vbc.exe
Token: SeCreatePagefilePrivilege	2988	vbc.exe
Token: SeBackupPrivilege	2988	vbc.exe
Token: SeRestorePrivilege	2988	vbc.exe
Token: SeShutdownPrivilege	2988	vbc.exe
Token: SeDebugPrivilege	2988	vbc.exe
Token: SeSystemEnvironmentPrivilege	2988	vbc.exe
Token: SeChangeNotifyPrivilege	2988	vbc.exe
Token: SeRemoteShutdownPrivilege	2988	vbc.exe
Token: SeUndockPrivilege	2988	vbc.exe
Token: SeManageVolumePrivilege	2988	vbc.exe
Token: SeImpersonatePrivilege	2988	vbc.exe
Token: SeCreateGlobalPrivilege	2988	vbc.exe
Token: 33	2988	vbc.exe
Token: 34	2988	vbc.exe
Token: 35	2988	vbc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2988	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	30
PID 2700 wrote to memory of 2668	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	31
PID 2700 wrote to memory of 2668	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	31
PID 2700 wrote to memory of 2668	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	31
PID 2700 wrote to memory of 2668	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	31
PID 2668 wrote to memory of 2584	2668	vbc.exe	33
PID 2668 wrote to memory of 2584	2668	vbc.exe	33
PID 2668 wrote to memory of 2584	2668	vbc.exe	33
PID 2668 wrote to memory of 2584	2668	vbc.exe	33
PID 2988 wrote to memory of 2604	2988	vbc.exe	34
PID 2988 wrote to memory of 2604	2988	vbc.exe	34
PID 2988 wrote to memory of 2604	2988	vbc.exe	34
PID 2988 wrote to memory of 2604	2988	vbc.exe	34
PID 2700 wrote to memory of 1552	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	36
PID 2700 wrote to memory of 1552	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	36
PID 2700 wrote to memory of 1552	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	36
PID 2700 wrote to memory of 1552	2700	JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe	36

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_374e6afe24154e3613673122861ce0cf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2604
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\omzthacu.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES36E9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc36E8.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Users\Admin\AppData\Roaming\639624.exe
  "C:\Users\Admin\AppData\Roaming\639624.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES36E9.tmp

Filesize
1KB

MD5
a5f452e06875da32b03e6bfcbf0ad59c

SHA1
fd3b5db5bf5662f88d2f04c83976cd3b0456b796

SHA256
6e543785f2f05f9804196d07b93f42da7a88dc9e9beda6d3e3d670670bc6a95f

SHA512
dddf90876ddedf1a4da9580e3a0e4c96809d425000e629302fdd192f419689603634b22e033a2e627c3c655e4be08c4125b72641b18870cd29da8fdb11a32f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\omzthacu.0.vb

Filesize
1KB

MD5
f5555e48384cd68aa11b1bd87b77a787

SHA1
46d9a88b64161f24a54beee58613dbcbaadfe509

SHA256
17617822583638e9f98c05066a19254fbefe9ffeed6890f0a99f65b44af0bd91

SHA512
41300bfa2c0c16b3f794594b5bfe4fbc85ec257bdd930b0ae4d151ad6a9869b5a22dbd9ddd8f834fe8096c56cf9f5d5c1553148c5e4c84f430f2e305f28d75f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\omzthacu.cmdline

Filesize
234B

MD5
1f7c5e7bedd13d75e15acca15021ed44

SHA1
6f0ae2a03cb9e497d151ec1957f0e3859321c556

SHA256
147e940988ca7c8ac2fab3008fa4ce28b4b77a5b0158e7597bd8ec72d083be05

SHA512
a8b21be5faff7f34dbccce3ed9241d359a9924179f949b5a2480febe8a3f502252d9b114cff911417eddc2b4d80df7c0b821f51331cb06954841228fa060d179

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc36E8.tmp

Filesize
880B

MD5
0ede81a10d8a8470634485061fe0a1d3

SHA1
5fdb47474f188620014469d2e98014de230bef9d

SHA256
08ab7778187d0e4c751e38a6bd395c0380088609b2663addc55e75a1ef6ed7e2

SHA512
7abae6d02b34d01ef2dd8fada7e25885974846ca2379e589e72fe6680684bef0698afce8679fca0026f2b78eb7473f2e4075291d0c687ca1755021482898ea70

Download Submit
C:\Users\Admin\AppData\Roaming\639624.exe

Filesize
7KB

MD5
0d0c6e4452ee6c82c0e4eda6631826e3

SHA1
b134efd9a8f94c8a7e998bc9e508e594fab59493

SHA256
87749799af8245411a11367ba00d99de4205adbe5a2e2ad17b428b1330343bdb

SHA512
fcac53f4c1b0a97b707d49182c590216ee4006a453ec73620b11a9746c21d201b22603341ae58dd087e18b5ea690eb7212f72b07fac24ebf1eb105283896bd1b

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/2668-36-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2668-27-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2700-1-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-2-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-51-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-0-0x0000000074351000-0x0000000074352000-memory.dmp

Filesize
4KB

Download
memory/2988-7-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-19-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2988-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-12-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-16-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-15-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-5-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-8-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-44-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-9-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2988-3-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads