darkcomet | 7a2b40243923cd5f7976e346b65a265bd2eac7c209ed722488fb63a1c882b06c

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
Size

522KB
MD5

1a711246b276ce21ea055b041b4a777e
SHA1

408b34c29da8cdb6cbf04d64b096c64e3c864b43
SHA256

7a2b40243923cd5f7976e346b65a265bd2eac7c209ed722488fb63a1c882b06c
SHA512

ae4875168a26eda43afdd65aebe7e22bd51492e2d2c088e0174ec72d9d6b0ae36a14d40ea0675da84538c26bdd16f100ff0999476b48ea6faa84080761477bd4
SSDEEP

12288:UmBvjkh9HLCmWltxoJngJn5Ivg49A6eM6MT9c769k:nvgnGmm95IICtX6MJK6W

Score

10^/10

darkcomet targets rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

TARGETS

darkjordan.zapto.org:99

Mutex

DC_MUTEX-6FPXA9V

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Z1MR6HYJYTTL
install
true
offline_keylogger
true
password
1983
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Suspicious use of SetThreadContext 1 IoCs

Processes:

1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

description pid process target process

PID 2216 set thread context of 2408 2216 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2548 2408 WerFault.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

description	pid	process	target process
PID 2216 set thread context of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

pid	pid_target	process	target process
2548	2408	WerFault.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

Modifies registry class 4 IoCs

Processes:

1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

pid process

2216 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

pid	process
2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216

C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe"
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 224
3⤵
- Program crash
PID:2548

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-4-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/2408-2-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2408-3-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2408-5-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2408-6-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2408-7-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download

description	pid	process	target process
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2216 wrote to memory of 2408	2216	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
PID 2408 wrote to memory of 2548	2408	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	WerFault.exe
PID 2408 wrote to memory of 2548	2408	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	WerFault.exe
PID 2408 wrote to memory of 2548	2408	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	WerFault.exe
PID 2408 wrote to memory of 2548	2408	1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe	WerFault.exe