darkcomet | d2d6bdbdd2588906af1326e15acc95e6c57da1fefcc6f47e7afbc6afe26c5f43

Analysis

max time kernel
150s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Size

355KB
MD5

6dc2283fb55cd0fde0341da8d56942d0
SHA1

dafbdd680d3ff148c6d92b242f9ad6cdea8ad820
SHA256

d2d6bdbdd2588906af1326e15acc95e6c57da1fefcc6f47e7afbc6afe26c5f43
SHA512

33e789b0e46d93933067acedbd40d391bbae0024070177631ce0e671772d1d31fd5a39b57edd271eac736d71269a451650003e008fedd9b4c2f24209ef9a797f
SSDEEP

6144:JFirrYQwFGDtvz1gk4vyl4/t0Sw0oamQzf5RQwRV5Rl6EqXqL1:4LhWk2tFVeaBzBWwRvR4+

Score

10^/10

darkcomet server discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Server

carbonfibers.myftp.biz:1657

Mutex

darksmoke

Attributes

InstallPath
winsrvc\svchost.exe
gencode
q0enFnK3Hmhu
install
true
offline_keylogger
true
persistence
true
reg_key
Services Host

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\winsrvc\\svchost.exe"	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe

Executes dropped EXE 2 IoCs

pid	Process
3024	svchost.exe
2824	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
3024	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services Host = "C:\\Users\\Admin\\AppData\\Roaming\\winsrvc\\svchost.exe"	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services Host = "C:\\Users\\Admin\\AppData\\Roaming\\winsrvc\\svchost.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 3024 set thread context of 2824	3024	svchost.exe	31

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2288-7-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-11-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-5-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-22-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-24-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-27-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-26-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-25-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-28-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2288-42-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2824-63-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2824-64-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2824-66-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2824-65-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2824-109-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	svchost.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeIncreaseQuotaPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeSecurityPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeTakeOwnershipPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeLoadDriverPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeSystemProfilePrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeSystemtimePrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeProfSingleProcessPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeIncBasePriorityPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeCreatePagefilePrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeBackupPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeRestorePrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeShutdownPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeDebugPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeSystemEnvironmentPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeChangeNotifyPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeRemoteShutdownPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeUndockPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeManageVolumePrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeImpersonatePrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeCreateGlobalPrivilege	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: 33	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: 34	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: 35	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
Token: SeDebugPrivilege	3024	svchost.exe
Token: SeIncreaseQuotaPrivilege	2824	svchost.exe
Token: SeSecurityPrivilege	2824	svchost.exe
Token: SeTakeOwnershipPrivilege	2824	svchost.exe
Token: SeLoadDriverPrivilege	2824	svchost.exe
Token: SeSystemProfilePrivilege	2824	svchost.exe
Token: SeSystemtimePrivilege	2824	svchost.exe
Token: SeProfSingleProcessPrivilege	2824	svchost.exe
Token: SeIncBasePriorityPrivilege	2824	svchost.exe
Token: SeCreatePagefilePrivilege	2824	svchost.exe
Token: SeBackupPrivilege	2824	svchost.exe
Token: SeRestorePrivilege	2824	svchost.exe
Token: SeShutdownPrivilege	2824	svchost.exe
Token: SeDebugPrivilege	2824	svchost.exe
Token: SeSystemEnvironmentPrivilege	2824	svchost.exe
Token: SeChangeNotifyPrivilege	2824	svchost.exe
Token: SeRemoteShutdownPrivilege	2824	svchost.exe
Token: SeUndockPrivilege	2824	svchost.exe
Token: SeManageVolumePrivilege	2824	svchost.exe
Token: SeImpersonatePrivilege	2824	svchost.exe
Token: SeCreateGlobalPrivilege	2824	svchost.exe
Token: 33	2824	svchost.exe
Token: 34	2824	svchost.exe
Token: 35	2824	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	svchost.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2380 wrote to memory of 2288	2380	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	29
PID 2288 wrote to memory of 3024	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	30
PID 2288 wrote to memory of 3024	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	30
PID 2288 wrote to memory of 3024	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	30
PID 2288 wrote to memory of 3024	2288	JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe	30
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 3024 wrote to memory of 2824	3024	svchost.exe	31
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32
PID 2824 wrote to memory of 1064	2824	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0.exe
  JaffaCakes118_6dc2283fb55cd0fde0341da8d56942d0
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Roaming\winsrvc\svchost.exe
    "C:\Users\Admin\AppData\Roaming\winsrvc\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Roaming\winsrvc\svchost.exe
      svchost
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\winsrvc\svchost.exe

Filesize
355KB

MD5
6dc2283fb55cd0fde0341da8d56942d0

SHA1
dafbdd680d3ff148c6d92b242f9ad6cdea8ad820

SHA256
d2d6bdbdd2588906af1326e15acc95e6c57da1fefcc6f47e7afbc6afe26c5f43

SHA512
33e789b0e46d93933067acedbd40d391bbae0024070177631ce0e671772d1d31fd5a39b57edd271eac736d71269a451650003e008fedd9b4c2f24209ef9a797f

Download Submit
memory/2288-22-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-7-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-27-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-24-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-11-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2288-5-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-3-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-26-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-42-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-28-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2288-25-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2380-23-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/2380-2-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/2380-1-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/2380-0-0x00000000745E1000-0x00000000745E2000-memory.dmp

Filesize
4KB

Download
memory/2380-12-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/2824-109-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2824-63-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2824-64-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2824-66-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2824-65-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download