Overview

overview

10

Static

static

10

3178fcad2d...18.exe

windows7-x64

10

3178fcad2d...18.exe

windows10-2004-x64

10

Resubmissions

10/04/2025, 02:11

250410-cmlj7ayvbz 10

10/04/2025, 02:03

250410-cg6m6sytez 10

10/04/2025, 02:02

250410-cf9cnsyjy3 10

31/03/2025, 04:10

250331-erp5aavqw3 10

04/11/2024, 23:05

241104-22x9zazdnp 10

10/10/2024, 19:23

241010-x34qxsxfql 10

Analysis

  • max time kernel
    0s
  • max time network
    1s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/03/2025, 04:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe

  • Size

    658KB

  • MD5

    3178fcad2d2c2f3c0f4f70aecfb18db7

  • SHA1

    0ecad6522214f9bef4dd8f2f8eb927827bc4971c

  • SHA256

    dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

  • SHA512

    57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-7X99PTF

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    DNgeskLTppzX

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    System32.dll

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2904
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe" +s +h
      2⤵
        PID:2708
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe" +s +h
          3⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:1972
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        2⤵
          PID:2744
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
            3⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:2600
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          2⤵
            PID:2620
          • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
            "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
            2⤵
              PID:2648

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
            Filesize

            658KB

            MD5

            3178fcad2d2c2f3c0f4f70aecfb18db7

            SHA1

            0ecad6522214f9bef4dd8f2f8eb927827bc4971c

            SHA256

            dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

            SHA512

            57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

            Download Submit

          • \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
            Filesize

            571KB

            MD5

            eab51eee5dfa37c71cc02bbaf7ca5168

            SHA1

            8fd1c0bb3f9754507aed1d70e7ac2934bb97236a

            SHA256

            7cc2177d59144b2c59ac4e6f24d38a7c1ccb3778b96637c4811ad7274b991fda

            SHA512

            a3b690f8fb2e438b22f64eab10b30e3779c1e223a44fb8ea4418a057c78525023f2c60fdd4c0ff7cfc48a922e3d10f7c327b20b7a69d814887ed25f8572c1457

            Download Submit

          • memory/2620-18-0x0000000000190000-0x0000000000191000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2620-3-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2904-0-0x0000000000270000-0x0000000000271000-memory.dmp

            Filesize

            4KB

            Download