darkcomet | 35a1772280f518a87b6778ba4bb388b192c67202f2ec4c76b056e8db167624ca

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/01/2025, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe
Size

1.2MB
MD5

658497c8c9ef6f24d71e03cfcee57700
SHA1

6a04eff1dd11351b1520e112465cd0dd73731c55
SHA256

35a1772280f518a87b6778ba4bb388b192c67202f2ec4c76b056e8db167624ca
SHA512

3f646ab7bd56b793d5f45a3a4f39176310ed21479091665c7aec8b95cadbc38492c4d06748a59718753de7c129eae419993d566517ef8eb2cbf077369451300a
SSDEEP

24576:yU26IocyuCRdsvk496tF+Fg+NrDL6ZvqV2j43K/cRgOnmq9g6OiYJY/RKPt:yUCocyuCz0k+AQSAHovXcOU7m6OzS/RI

Score

10^/10

darkcomet guest16 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

algerinooo.ddns.net:1604

Mutex

DC_MUTEX-8631A1S

Attributes

gencode
MLZlM4WyBLH5
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Executes dropped EXE 1 IoCs

pid	Process
2192	377.exe

Loads dropped DLL 2 IoCs

pid	Process
576	JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe
576	JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	377.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2192	377.exe
Token: SeSecurityPrivilege	2192	377.exe
Token: SeTakeOwnershipPrivilege	2192	377.exe
Token: SeLoadDriverPrivilege	2192	377.exe
Token: SeSystemProfilePrivilege	2192	377.exe
Token: SeSystemtimePrivilege	2192	377.exe
Token: SeProfSingleProcessPrivilege	2192	377.exe
Token: SeIncBasePriorityPrivilege	2192	377.exe
Token: SeCreatePagefilePrivilege	2192	377.exe
Token: SeBackupPrivilege	2192	377.exe
Token: SeRestorePrivilege	2192	377.exe
Token: SeShutdownPrivilege	2192	377.exe
Token: SeDebugPrivilege	2192	377.exe
Token: SeSystemEnvironmentPrivilege	2192	377.exe
Token: SeChangeNotifyPrivilege	2192	377.exe
Token: SeRemoteShutdownPrivilege	2192	377.exe
Token: SeUndockPrivilege	2192	377.exe
Token: SeManageVolumePrivilege	2192	377.exe
Token: SeImpersonatePrivilege	2192	377.exe
Token: SeCreateGlobalPrivilege	2192	377.exe
Token: 33	2192	377.exe
Token: 34	2192	377.exe
Token: 35	2192	377.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	377.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2192	576	JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe	32
PID 576 wrote to memory of 2192	576	JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe	32
PID 576 wrote to memory of 2192	576	JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe	32
PID 576 wrote to memory of 2192	576	JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\377.exe
  C:\Users\Admin\AppData\Local\Temp\377.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\377.exe

Filesize
658KB

MD5
8bd92dee950bf6d09b8240dfb6bf7ffb

SHA1
3bf5a6a49c8100b0812b9c6c8649a036b2ce0d85

SHA256
66a8a79cec9360edc8f3db2f8930734f6f0935db5091c2d3305099ada99c215c

SHA512
29df1d77e17a75c96ec0e64958274d460fade736229e538289135e5a8c730fb47e7a67a9798d65f30bf0b38c6c494bff682bd76c554fb3c95ee063da6bd0cba9

Download Submit
memory/576-22-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/576-17-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/576-14-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/576-13-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-12-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-11-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-10-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-9-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-8-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-7-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-6-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/576-5-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/576-4-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/576-24-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/576-2-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/576-25-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/576-16-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/576-20-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/576-19-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/576-18-0x00000000031D0000-0x00000000031D2000-memory.dmp

Filesize
8KB

Download
memory/576-21-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/576-0-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/576-15-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/576-26-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/576-3-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/576-23-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/576-27-0x0000000006140000-0x0000000006334000-memory.dmp

Filesize
2.0MB

Download
memory/576-28-0x0000000005F50000-0x0000000006144000-memory.dmp

Filesize
2.0MB

Download
memory/576-1-0x0000000001D80000-0x0000000001DE0000-memory.dmp

Filesize
384KB

Download
memory/576-39-0x0000000001D80000-0x0000000001DE0000-memory.dmp

Filesize
384KB

Download
memory/576-40-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/2192-50-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-53-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-43-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-44-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-45-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-41-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-49-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-48-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-47-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-51-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-52-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-46-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2192-54-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download