darkcomet | c4cf9bb4bd8f7f55d1ce288d7dede57fcf6e048e38d47fa00661dade54b9526f

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe
Size

456KB
MD5

698442d3c6267aafd2a2d6157bce2a90
SHA1

7586cb460785076c24be81aa3e8d7928c1d806c4
SHA256

c4cf9bb4bd8f7f55d1ce288d7dede57fcf6e048e38d47fa00661dade54b9526f
SHA512

a652379f986e75d09d9aa8bc1f71be2cc672ec256fc8c537e47d69fa69c94d155111f8e50543a9728f7eca91887bebd18bccc77e7e74332dce0f1a1c01025e3e
SSDEEP

6144:9gHNSzfilEOBuc37a8IaVWJk+1lFP+IjwVAItNZWcv7DVNDrZ+CtJSn8bp26:9ga2Ln3nIsWJk+xlwVAItNZ9vLuK

Score

10^/10

darkcomet clients defense_evasion discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Clients

donbiz.no-ip.biz:1604

Mutex

DC_MUTEX-B5WXAJQ

Attributes

gencode
wwPkqHq7l2zl
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Executes dropped EXE 2 IoCs

pid	Process
2904	winlog.exe
2872	csrss.exe

Loads dropped DLL 4 IoCs

pid	Process
2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe
2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe
2904	winlog.exe
2904	winlog.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wins = "C:\\Users\\Admin\\AppData\\Roaming\\winlog.exe"	winlog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wins = "C:\\Users\\Admin\\AppData\\Roaming\\winlog.exe"	winlog.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wins = "C:\\Users\\Admin\\AppData\\Roaming\\winlog.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wins = "C:\\Users\\Admin\\AppData\\Roaming\\winlog.exe"	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 2900	2904	winlog.exe	36

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-33-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-29-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-40-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-39-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-38-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-25-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-42-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-41-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-55-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-57-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-58-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-59-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-60-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-61-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-62-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-63-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2900-64-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe:ZONE.identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\winlog.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\csrss.exe\:ZONE.identifier:$DATA	winlog.exe
File created	C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\winlog.exe\:ZONE.identifier:$DATA	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\winlog.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2904	winlog.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe
2872	csrss.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	winlog.exe
Token: SeIncreaseQuotaPrivilege	2900	vbc.exe
Token: SeSecurityPrivilege	2900	vbc.exe
Token: SeTakeOwnershipPrivilege	2900	vbc.exe
Token: SeLoadDriverPrivilege	2900	vbc.exe
Token: SeSystemProfilePrivilege	2900	vbc.exe
Token: SeSystemtimePrivilege	2900	vbc.exe
Token: SeProfSingleProcessPrivilege	2900	vbc.exe
Token: SeIncBasePriorityPrivilege	2900	vbc.exe
Token: SeCreatePagefilePrivilege	2900	vbc.exe
Token: SeBackupPrivilege	2900	vbc.exe
Token: SeRestorePrivilege	2900	vbc.exe
Token: SeShutdownPrivilege	2900	vbc.exe
Token: SeDebugPrivilege	2900	vbc.exe
Token: SeSystemEnvironmentPrivilege	2900	vbc.exe
Token: SeChangeNotifyPrivilege	2900	vbc.exe
Token: SeRemoteShutdownPrivilege	2900	vbc.exe
Token: SeUndockPrivilege	2900	vbc.exe
Token: SeManageVolumePrivilege	2900	vbc.exe
Token: SeImpersonatePrivilege	2900	vbc.exe
Token: SeCreateGlobalPrivilege	2900	vbc.exe
Token: 33	2900	vbc.exe
Token: 34	2900	vbc.exe
Token: 35	2900	vbc.exe
Token: SeDebugPrivilege	2872	csrss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	vbc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2684	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	31
PID 2672 wrote to memory of 2684	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	31
PID 2672 wrote to memory of 2684	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	31
PID 2672 wrote to memory of 2684	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	31
PID 2672 wrote to memory of 2904	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	33
PID 2672 wrote to memory of 2904	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	33
PID 2672 wrote to memory of 2904	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	33
PID 2672 wrote to memory of 2904	2672	JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe	33
PID 2904 wrote to memory of 2608	2904	winlog.exe	34
PID 2904 wrote to memory of 2608	2904	winlog.exe	34
PID 2904 wrote to memory of 2608	2904	winlog.exe	34
PID 2904 wrote to memory of 2608	2904	winlog.exe	34
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2900	2904	winlog.exe	36
PID 2904 wrote to memory of 2872	2904	winlog.exe	37
PID 2904 wrote to memory of 2872	2904	winlog.exe	37
PID 2904 wrote to memory of 2872	2904	winlog.exe	37
PID 2904 wrote to memory of 2872	2904	winlog.exe	37

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe":ZONE.identifier & exit
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2684
- C:\Users\Admin\AppData\Roaming\winlog.exe
  "C:\Users\Admin\AppData\Roaming\winlog.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Roaming\winlog.exe":ZONE.identifier & exit
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:2608
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2900
- - C:\Users\Admin\AppData\Roaming\csrss.exe
    "C:\Users\Admin\AppData\Roaming\csrss.exe" -reg C:\Users\Admin\AppData\Roaming\winlog.exe -proc 2900 C:\Users\Admin\AppData\Roaming\winlog.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_698442d3c6267aafd2a2d6157bce2a90.exe

Filesize
456KB

MD5
698442d3c6267aafd2a2d6157bce2a90

SHA1
7586cb460785076c24be81aa3e8d7928c1d806c4

SHA256
c4cf9bb4bd8f7f55d1ce288d7dede57fcf6e048e38d47fa00661dade54b9526f

SHA512
a652379f986e75d09d9aa8bc1f71be2cc672ec256fc8c537e47d69fa69c94d155111f8e50543a9728f7eca91887bebd18bccc77e7e74332dce0f1a1c01025e3e

Download Submit
C:\Users\Admin\AppData\Roaming\csrss.exe:ZONE.identifier

Filesize
28B

MD5
90fd34c6bd120fb6d41d18161a05296b

SHA1
346e55ea4c486d9f4ac7e65793c34fc18e5a28b1

SHA256
53c9dbb7d60a9fd6c12d2580557472f0132cc26c055e2e841b455be1b8713695

SHA512
74a0d8a648267a6c2a31cecd076a3d30d59951ca3e00b8e2e0a935a709cd105c6a8da2da6988f4c3bbef13aea3ad9a805547e8373e57a471d1f794db4ca4709e

Download Submit
memory/2672-1-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-2-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-3-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-17-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-0-0x00000000741F1000-0x00000000741F2000-memory.dmp

Filesize
4KB

Download
memory/2900-57-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-23-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-33-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-29-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-40-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-39-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-38-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-64-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-25-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-60-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2900-42-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-41-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-63-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-62-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-61-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-58-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2900-59-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2904-19-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2904-20-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2904-54-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2904-53-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2904-21-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download