darkcomet | 803c89efe08eb9dd7dc35bd886818e61ffa82762d75f63c9d2691dd66e703524

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Size

393KB
MD5

1df9fece0dd4500c39dbe9544959a9b7
SHA1

5e3a78348a7c8227324e7c586c9f1705d9f1e042
SHA256

803c89efe08eb9dd7dc35bd886818e61ffa82762d75f63c9d2691dd66e703524
SHA512

0bce0589f10d9c76db128dd74d284fe9708f43099dd7a2827f108a82ac5116f906e4f5fb4c0892f9f00f9aa856dd6b478e9ffc7849e7a25b696aafcf9ca8a9a6
SSDEEP

6144:NcfcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37jNkb/XM3jxNxW0Y0zlVYFAbQ:NcfcW7KEZlPzCy37jNW/XgxNXli3

Score

10^/10

darkcomet latentbot guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

romanticboy.zapto.org:1604

Mutex

DC_MUTEX-DJQBFWY

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
lG6FsTBjX2NM
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Extracted

Family

latentbot

romanticboy.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

msdcsc.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2060 attrib.exe
2136 attrib.exe
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2532 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

pid process

2092 1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
2092 1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

msdcsc.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

pid	process
2060	attrib.exe
2136	attrib.exe

pid	process
2532	msdcsc.exe

pid	process
2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

Processes:

1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2804 2392 WerFault.exe notepad.exe
1064 1708 WerFault.exe notepad.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2532 msdcsc.exe

pid	pid_target	process	target process
2804	2392	WerFault.exe	notepad.exe
1064	1708	WerFault.exe	notepad.exe

pid	process
2532	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeSecurityPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeBackupPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeRestorePrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeShutdownPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeDebugPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeUndockPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: 33	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: 34	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: 35	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2532	msdcsc.exe
Token: SeSecurityPrivilege	2532	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2532	msdcsc.exe
Token: SeLoadDriverPrivilege	2532	msdcsc.exe
Token: SeSystemProfilePrivilege	2532	msdcsc.exe
Token: SeSystemtimePrivilege	2532	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2532	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2532	msdcsc.exe
Token: SeCreatePagefilePrivilege	2532	msdcsc.exe
Token: SeBackupPrivilege	2532	msdcsc.exe
Token: SeRestorePrivilege	2532	msdcsc.exe
Token: SeShutdownPrivilege	2532	msdcsc.exe
Token: SeDebugPrivilege	2532	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2532	msdcsc.exe
Token: SeChangeNotifyPrivilege	2532	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2532	msdcsc.exe
Token: SeUndockPrivilege	2532	msdcsc.exe
Token: SeManageVolumePrivilege	2532	msdcsc.exe
Token: SeImpersonatePrivilege	2532	msdcsc.exe
Token: SeCreateGlobalPrivilege	2532	msdcsc.exe
Token: 33	2532	msdcsc.exe
Token: 34	2532	msdcsc.exe
Token: 35	2532	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2532 msdcsc.exe

pid	process
2532	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.execmd.execmd.exenotepad.exemsdcsc.exe

description	pid	process	target process
PID 2092 wrote to memory of 2928	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2092 wrote to memory of 2928	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2092 wrote to memory of 2928	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2092 wrote to memory of 2928	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2092 wrote to memory of 2180	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2092 wrote to memory of 2180	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2092 wrote to memory of 2180	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2092 wrote to memory of 2180	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	cmd.exe
PID 2180 wrote to memory of 2060	2180	cmd.exe	attrib.exe
PID 2180 wrote to memory of 2060	2180	cmd.exe	attrib.exe
PID 2180 wrote to memory of 2060	2180	cmd.exe	attrib.exe
PID 2180 wrote to memory of 2060	2180	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2136	2928	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2136	2928	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2136	2928	cmd.exe	attrib.exe
PID 2928 wrote to memory of 2136	2928	cmd.exe	attrib.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2092 wrote to memory of 2392	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	notepad.exe
PID 2392 wrote to memory of 2804	2392	notepad.exe	WerFault.exe
PID 2392 wrote to memory of 2804	2392	notepad.exe	WerFault.exe
PID 2392 wrote to memory of 2804	2392	notepad.exe	WerFault.exe
PID 2392 wrote to memory of 2804	2392	notepad.exe	WerFault.exe
PID 2092 wrote to memory of 2532	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	msdcsc.exe
PID 2092 wrote to memory of 2532	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	msdcsc.exe
PID 2092 wrote to memory of 2532	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	msdcsc.exe
PID 2092 wrote to memory of 2532	2092	1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe	msdcsc.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe
PID 2532 wrote to memory of 1708	2532	msdcsc.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2060 attrib.exe
2136 attrib.exe

pid	process
2060	attrib.exe
2136	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\1df9fece0dd4500c39dbe9544959a9b7_JaffaCakes118.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2136

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2060

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 264
3⤵
- Program crash
PID:2804

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 196
4⤵
- Program crash
PID:1064

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
393KB

MD5
1df9fece0dd4500c39dbe9544959a9b7

SHA1
5e3a78348a7c8227324e7c586c9f1705d9f1e042

SHA256
803c89efe08eb9dd7dc35bd886818e61ffa82762d75f63c9d2691dd66e703524

SHA512
0bce0589f10d9c76db128dd74d284fe9708f43099dd7a2827f108a82ac5116f906e4f5fb4c0892f9f00f9aa856dd6b478e9ffc7849e7a25b696aafcf9ca8a9a6

Download Submit
memory/2092-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/2092-1-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2092-41-0x0000000004760000-0x000000000484E000-memory.dmp

Filesize
952KB

Download
memory/2092-85-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/2392-5-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2392-33-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2532-43-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/2532-88-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download