darkcomet | 467133ae0674f7f6b6d5f2f4f788118b88aa1c09f3c966826b9ade5b4f2379fc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe
Size

740KB
MD5

6213e41a15ae74c8b5f502fdca12bebf
SHA1

afb0a9001eb83164d36d85b1df8ffbfaa5979c2b
SHA256

467133ae0674f7f6b6d5f2f4f788118b88aa1c09f3c966826b9ade5b4f2379fc
SHA512

17c5a27a27a71a95db39e1b626da3c898a298bdfce54b072926a1a556800493d3e316c36b3c0f9d27a065dff16ba078ffc89dcf379ce519b4d7fc9b30be61538
SSDEEP

12288:MXkXyENrDviHr24/zBKD19kyGWpeo8eLbbVRJgPg6396tGXpAbHLDwYQ9bkU4Nu:QUxrDva7BKDLkyGWpueLOuRrLK9leu

Score

10^/10

darkcomet discovery rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Executes dropped EXE 1 IoCs

pid	Process
4068	01.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4196	4068	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4068	4808	JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe	83
PID 4808 wrote to memory of 4068	4808	JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe	83
PID 4808 wrote to memory of 4068	4808	JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6213e41a15ae74c8b5f502fdca12bebf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\01.exe
  C:\Users\Admin\AppData\Local\Temp\01.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 664
    3⤵
    - Program crash
    PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4068 -ip 4068
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\01.exe

Filesize
691KB

MD5
3514c57923ef67b533aa0cb221c15b49

SHA1
93015c9471023ae629d9093a8e2051c3d001d1cb

SHA256
77d1597cb6a904832122635810cbe29451c99dfa71f6a54b81c666be9ea98d33

SHA512
28861b71943d0d1d80aa553f62fadacd3273951e58e5381f1c494df74ce8a5cb41422e09ffd6caad78c313279d261cc10285ef6fa2d14bbf3e85b5d976645410

Download Submit
memory/4068-8-0x0000000013140000-0x00000000131FF000-memory.dmp

Filesize
764KB

Download