darkcomet | c2cb75c2264724f5940f8dce6aa3525f9271f2179bd4b54b6f59c3c77003f19a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2025, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe
Size 492KB
Sample250124-cts8lsvmaz
SHA256 c2cb75c2264724f5940f8dce6aa3525f9271f2179bd4b54b6f59c3c77003f19a
MD5 1d1a5d4542b4685e0ecbd7638fb261d9
SHA1 147d244f45e2cc4ccf7464e68c8a96e94cbb157b
SHA512 32525d3fdae59aa19737a8a28e89df61e1c54452d88af5de1af41cfc693f047a578b4ad7f87f05b615e661debed5d6f0761f1c1f8e79134e7b4cdf9196b40114
SSDEEP 12288:7JUNgfIocgadyq9VUl15E0SiQq5bjGlYWS5Ykch4JWdOJ:7OmIoIyq/UPTS25Gudk2JfJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-EY448Z3

Attributes

gencode
S9CmtCsHri6f
install
false
offline_keylogger
false
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Executes dropped EXE 2 IoCs

pid	Process
4468	asdf2.exe
3080	asdf2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdf2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdf2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4468	772	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe	82
PID 772 wrote to memory of 4468	772	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe	82
PID 772 wrote to memory of 4468	772	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe	82
PID 772 wrote to memory of 3080	772	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe	83
PID 772 wrote to memory of 3080	772	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe	83
PID 772 wrote to memory of 3080	772	JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\asdf2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\asdf2.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4468
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\asdf2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\asdf2.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

asdf2.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\asdf2.exe
Size 418KB
SHA256 b2708fbda2bbd996fa7e3f26726f7ea1d1367cf6150eb814154eb7bf07e88140
MD5 b84e0afd40ad8e0f49fc3da803f94218
SHA1 a31ba4683b6e0fc3f5e77c51855511db2ce1bd85
SHA512 88c0fddce12fa72cd073b2e1b87c3569bd93b0c7864582f1424acee9110ad4800811a27faa74fa1f15fafcfed00cafd2eff1589147754249fb2bcbafe6a1f3da
SSDEEP 12288:XE2d+d0yZ9VUlj5E0SiQF5bGOjnNtTirdKW:ddW0yZ/UFTSx5yOjvTEdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3080-11-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/3080-12-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4468-5-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4468-6-0x00000000022D0000-0x0000000002313000-memory.dmp

Download

memory/4468-7-0x0000000002500000-0x0000000002504000-memory.dmp

Download

memory/4468-8-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4468-9-0x00000000022D0000-0x0000000002313000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads