darkcomet | da204cf93005c61a0fc0cc4ece8c9b9bf7b63198af29cdeeb3ac190f59d39195

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Size

896KB
MD5

1b7680e1fc999d748b468ce218fe0473
SHA1

08f4dfa1068b2f546b8131d483b7c4553349e897
SHA256

da204cf93005c61a0fc0cc4ece8c9b9bf7b63198af29cdeeb3ac190f59d39195
SHA512

59b3fbfcc38d590b6c26b5c9b555c36b15d0573000fbdd8cc5ffd257a181e46505b262469fd42006b857d82701b0f4ced4a6d63069a4692065704938c665b9b3
SSDEEP

12288:OHZEOCafvtr2AIFKGg3s9CibaPKiCR8APGpYqckJPArSWPGX76ax+G+1km3CekJB:sZEOCadKdQTAjb276ugBOISm7D2orK

Score

10^/10

darkcomet ãäêïì persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

ãäÊÏì

nnns.zapto.org:4433

Mutex

DC_MUTEX-HTT3CAX

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
BkangWFkKcGv
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe

Drops file in Drivers directory 1 IoCs

Processes:

1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts 1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2304 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe

pid process

2748 1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
2748 1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe

pid	process
2304	msdcsc.exe

pid	process
2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeSecurityPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeBackupPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeRestorePrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeShutdownPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeDebugPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeUndockPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: 33	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: 34	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: 35	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2304	msdcsc.exe
Token: SeSecurityPrivilege	2304	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2304	msdcsc.exe
Token: SeLoadDriverPrivilege	2304	msdcsc.exe
Token: SeSystemProfilePrivilege	2304	msdcsc.exe
Token: SeSystemtimePrivilege	2304	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2304	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2304	msdcsc.exe
Token: SeCreatePagefilePrivilege	2304	msdcsc.exe
Token: SeBackupPrivilege	2304	msdcsc.exe
Token: SeRestorePrivilege	2304	msdcsc.exe
Token: SeShutdownPrivilege	2304	msdcsc.exe
Token: SeDebugPrivilege	2304	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2304	msdcsc.exe
Token: SeChangeNotifyPrivilege	2304	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2304	msdcsc.exe
Token: SeUndockPrivilege	2304	msdcsc.exe
Token: SeManageVolumePrivilege	2304	msdcsc.exe
Token: SeImpersonatePrivilege	2304	msdcsc.exe
Token: SeCreateGlobalPrivilege	2304	msdcsc.exe
Token: 33	2304	msdcsc.exe
Token: 34	2304	msdcsc.exe
Token: 35	2304	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2304 msdcsc.exe

pid	process
2304	msdcsc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exemsdcsc.exe

description	pid	process	target process
PID 2748 wrote to memory of 2304	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe	msdcsc.exe
PID 2748 wrote to memory of 2304	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe	msdcsc.exe
PID 2748 wrote to memory of 2304	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe	msdcsc.exe
PID 2748 wrote to memory of 2304	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe	msdcsc.exe
PID 2748 wrote to memory of 2304	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe	msdcsc.exe
PID 2748 wrote to memory of 2304	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe	msdcsc.exe
PID 2748 wrote to memory of 2304	2748	1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe	msdcsc.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe
PID 2304 wrote to memory of 2476	2304	msdcsc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b7680e1fc999d748b468ce218fe0473_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
658KB

MD5
3f8ff69725b60d0f4d376e9bc747d488

SHA1
b9450e6b3b48971a809ef83b883ee2063bf75be3

SHA256
1f9838094d5e0a10430266830c4b066a2ffaba9000b97d7ee87bfe4722866a22

SHA512
015c9fec4b5669cbe77d9e0ad981b3885aaedaddffd2c39120e266f00cb97cb0f8a016def1e2831c35ea976a6e8b91cd924becf304f84627cb53b69bb6c53aac

Download Submit
memory/2304-33-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-91-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-34-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-90-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-89-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-88-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-87-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-86-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-21-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/2304-19-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/2304-27-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-29-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-28-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-26-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-25-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-24-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-30-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-32-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-85-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-84-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-79-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2304-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2476-35-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2476-73-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2748-6-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2748-3-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/2748-4-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2748-76-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2748-0-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2748-8-0x0000000075100000-0x0000000075210000-memory.dmp

Filesize
1.1MB

Download
memory/2748-1-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/2748-74-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2748-7-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2748-75-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/2748-2-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/2748-5-0x0000000075111000-0x0000000075112000-memory.dmp

Filesize
4KB

Download