darkcomet | 44c8432c6320b43a0d6020ead65ad2f218931c7038969702a0ffbfa862b65c61

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-02-2025 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe
Size

718KB
MD5

b24fe9f75a54f69e549e663955428014
SHA1

903a55a40827c4ec9d171b2acb5e372e42fcccfb
SHA256

44c8432c6320b43a0d6020ead65ad2f218931c7038969702a0ffbfa862b65c61
SHA512

4e73ff762270f379bd21c6aae7e39f1f871390ea34585380b0517507931d425608d36271ce459e5767499cf0df91a6698b866fa1644ad9a088f2695ed3b6d825
SSDEEP

12288:2hcW7U/HYD5q7c/WCMHV2+awfiIHicRN0Dc9loeXDhOWy:2hc2q4VqY+zU+zLKIlLhOR

Score

10^/10

darkcomet hawkeye discovery keylogger persistence rat spyware stealer trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Deletes itself 1 IoCs

pid	Process
2404	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe

Loads dropped DLL 6 IoCs

pid	Process
2192	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe
2192	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe
2404	explorer.exe
2404	explorer.exe
2648	igfpers.exe
2648	igfpers.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA User Experience Driver Component = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\igfpers.exe"	igfpers.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2720	2404	explorer.exe	31
PID 2676 set thread context of 2664	2676	sqlserver.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfpers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe
2648	igfpers.exe
2676	sqlserver.exe
2404	explorer.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe
Token: SeDebugPrivilege	2404	explorer.exe
Token: SeIncreaseQuotaPrivilege	2720	AppLaunch.exe
Token: SeSecurityPrivilege	2720	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	2720	AppLaunch.exe
Token: SeLoadDriverPrivilege	2720	AppLaunch.exe
Token: SeSystemProfilePrivilege	2720	AppLaunch.exe
Token: SeSystemtimePrivilege	2720	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	2720	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	2720	AppLaunch.exe
Token: SeCreatePagefilePrivilege	2720	AppLaunch.exe
Token: SeBackupPrivilege	2720	AppLaunch.exe
Token: SeRestorePrivilege	2720	AppLaunch.exe
Token: SeShutdownPrivilege	2720	AppLaunch.exe
Token: SeDebugPrivilege	2720	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	2720	AppLaunch.exe
Token: SeChangeNotifyPrivilege	2720	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	2720	AppLaunch.exe
Token: SeUndockPrivilege	2720	AppLaunch.exe
Token: SeManageVolumePrivilege	2720	AppLaunch.exe
Token: SeImpersonatePrivilege	2720	AppLaunch.exe
Token: SeCreateGlobalPrivilege	2720	AppLaunch.exe
Token: 33	2720	AppLaunch.exe
Token: 34	2720	AppLaunch.exe
Token: 35	2720	AppLaunch.exe
Token: SeDebugPrivilege	2648	igfpers.exe
Token: SeDebugPrivilege	2676	sqlserver.exe
Token: SeIncreaseQuotaPrivilege	2664	AppLaunch.exe
Token: SeSecurityPrivilege	2664	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	2664	AppLaunch.exe
Token: SeLoadDriverPrivilege	2664	AppLaunch.exe
Token: SeSystemProfilePrivilege	2664	AppLaunch.exe
Token: SeSystemtimePrivilege	2664	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	2664	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	2664	AppLaunch.exe
Token: SeCreatePagefilePrivilege	2664	AppLaunch.exe
Token: SeBackupPrivilege	2664	AppLaunch.exe
Token: SeRestorePrivilege	2664	AppLaunch.exe
Token: SeShutdownPrivilege	2664	AppLaunch.exe
Token: SeDebugPrivilege	2664	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	2664	AppLaunch.exe
Token: SeChangeNotifyPrivilege	2664	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	2664	AppLaunch.exe
Token: SeUndockPrivilege	2664	AppLaunch.exe
Token: SeManageVolumePrivilege	2664	AppLaunch.exe
Token: SeImpersonatePrivilege	2664	AppLaunch.exe
Token: SeCreateGlobalPrivilege	2664	AppLaunch.exe
Token: 33	2664	AppLaunch.exe
Token: 34	2664	AppLaunch.exe
Token: 35	2664	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2720	AppLaunch.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2404	2192	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe	30
PID 2192 wrote to memory of 2404	2192	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe	30
PID 2192 wrote to memory of 2404	2192	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe	30
PID 2192 wrote to memory of 2404	2192	JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe	30
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2720	2404	explorer.exe	31
PID 2404 wrote to memory of 2648	2404	explorer.exe	32
PID 2404 wrote to memory of 2648	2404	explorer.exe	32
PID 2404 wrote to memory of 2648	2404	explorer.exe	32
PID 2404 wrote to memory of 2648	2404	explorer.exe	32
PID 2648 wrote to memory of 2676	2648	igfpers.exe	33
PID 2648 wrote to memory of 2676	2648	igfpers.exe	33
PID 2648 wrote to memory of 2676	2648	igfpers.exe	33
PID 2648 wrote to memory of 2676	2648	igfpers.exe	33
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34
PID 2676 wrote to memory of 2664	2676	sqlserver.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b24fe9f75a54f69e549e663955428014.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\System\igfpers.exe
    "C:\Users\Admin\AppData\Local\Temp\System\igfpers.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\System\sqlserver.exe
      "C:\Users\Admin\AppData\Local\Temp\System\sqlserver.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
8c381b88e633b152ed7a1205cbff748a

SHA1
36a1ee7236de78747f0ce1e7fcbbbf1bccb844e2

SHA256
ed6cfd5c7b306ffe6f3bdeb7d7011e6fe9ce592006b28d2f4b683148b4b2a8ca

SHA512
9574e44f14add7b35fe43a4736bb5cd4c7bee207350b47504328d3ac939b2c050feffb248fccc9188c2f0c04d348c3b62a447ab8cbaa16f1b570d86f4def7ecd

Download Submit
\Users\Admin\AppData\Local\Temp\System\igfpers.exe

Filesize
36KB

MD5
3947d1ec4b3921ee45dc615cdb41289a

SHA1
050df6cda2476da1f7f1594985b6add5ccf51d02

SHA256
c1facc2d77e87d8210e74029e639b05dd7482aa2b1eb2e7cc7699ec45aa96b71

SHA512
03313943fe821fbf5b099a9fa329f9f2fce8489bb48084c40ac852fa20e9d685aeaad26888e88791f66f477ac04dc0db318344eed7c81b7062cddb2f497bc333

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
718KB

MD5
b24fe9f75a54f69e549e663955428014

SHA1
903a55a40827c4ec9d171b2acb5e372e42fcccfb

SHA256
44c8432c6320b43a0d6020ead65ad2f218931c7038969702a0ffbfa862b65c61

SHA512
4e73ff762270f379bd21c6aae7e39f1f871390ea34585380b0517507931d425608d36271ce459e5767499cf0df91a6698b866fa1644ad9a088f2695ed3b6d825

Download Submit
memory/2192-0-0x0000000074641000-0x0000000074642000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/2192-2-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/2192-14-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/2404-17-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/2404-16-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/2404-15-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/2404-73-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/2720-40-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-39-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-32-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2720-30-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-29-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-28-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-27-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-25-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-34-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-42-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-45-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-44-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-43-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-38-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-23-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2720-74-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download