darkcomet | 6dbc41a48a41c991800d78eb2bd7231512830620880febda4a17e75c4f438a56

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2025, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Size

930KB
MD5

c52d6bfcb18b48ce0976886fc1c60967
SHA1

da6575713f50dae6e3ea4fac5aaf0d983c351171
SHA256

6dbc41a48a41c991800d78eb2bd7231512830620880febda4a17e75c4f438a56
SHA512

dc764e1d42bf9a74b5ac14be8ba01c1dfcf013456b2d403bf0e3616a440a5f124fde0909f207eeb02de3ebdad5e65425fb7f86ac204c6e3090ceb8973a19e0e0
SSDEEP

24576:KZ1xuVVjfFoynPaVBUR8f+kN10EBxYAGrW:aQDgok30bAz

Score

10^/10

darkcomet discovery rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Downloads MZ/PE file 1 IoCs

flow	pid	Process
50	4820	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\Control Panel\International\Geo\Nation	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe

Executes dropped EXE 1 IoCs

pid	Process
968	BIT.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BIT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2260	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeSecurityPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeTakeOwnershipPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeLoadDriverPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeSystemProfilePrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeSystemtimePrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeProfSingleProcessPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeIncBasePriorityPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeCreatePagefilePrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeBackupPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeRestorePrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeShutdownPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeDebugPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeSystemEnvironmentPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeChangeNotifyPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeRemoteShutdownPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeUndockPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeManageVolumePrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeImpersonatePrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: SeCreateGlobalPrivilege	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: 33	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: 34	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: 35	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
Token: 36	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
4904	javaw.exe
4904	javaw.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 968	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe	87
PID 3872 wrote to memory of 968	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe	87
PID 3872 wrote to memory of 968	3872	JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe	87
PID 968 wrote to memory of 4904	968	BIT.EXE	88
PID 968 wrote to memory of 4904	968	BIT.EXE	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c52d6bfcb18b48ce0976886fc1c60967.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\BIT.EXE
  "C:\Users\Admin\AppData\Local\Temp\BIT.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xms512m -Xmx1024m -jar "C:\Users\Admin\AppData\Local\Temp\BIT.EXE"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4904

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzE1Q0Q4NzctRDIyQy00QjA4LUJERjgtNDdBRjMxQkQ0QzA3fSIgdXNlcmlkPSJ7MzIzNEMxREYtMjcwNS00NDYxLTkxNUYtRDZDQzExMDczMkNGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTczOUM2NzktNUZBRS00QkEwLTlBRjEtOUEzMDY4NEQ0ODEzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODg3MjgwODI3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BIT.EXE

Filesize
272KB

MD5
f3af9e6be544b4a28b2abff08292cde6

SHA1
ce72c12d42135bf9951570f54f8c97d2cd9ea297

SHA256
96ff47ed3a6ee136f5ba1e14ae20f1cc95c20747db444e4b6ed66ef3fe7d7679

SHA512
d84aea057738519472cec5128e1efb32cf18f49ba18942ac46ceecf62ce86a803f95151bc3f9e9860484a27beeaf08c076a6838c2279af40cd1307a93c7be85b

Download Submit
memory/968-9-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3872-0-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3872-51-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4904-12-0x000001A1341E0000-0x000001A134450000-memory.dmp

Filesize
2.4MB

Download
memory/4904-24-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-36-0x000001A134450000-0x000001A134460000-memory.dmp

Filesize
64KB

Download
memory/4904-38-0x000001A134460000-0x000001A134470000-memory.dmp

Filesize
64KB

Download
memory/4904-40-0x000001A134470000-0x000001A134480000-memory.dmp

Filesize
64KB

Download
memory/4904-42-0x000001A134480000-0x000001A134490000-memory.dmp

Filesize
64KB

Download
memory/4904-44-0x000001A134490000-0x000001A1344A0000-memory.dmp

Filesize
64KB

Download
memory/4904-47-0x000001A1344A0000-0x000001A1344B0000-memory.dmp

Filesize
64KB

Download
memory/4904-48-0x000001A1344B0000-0x000001A1344C0000-memory.dmp

Filesize
64KB

Download
memory/4904-54-0x000001A1341E0000-0x000001A134450000-memory.dmp

Filesize
2.4MB

Download
memory/4904-53-0x000001A1344D0000-0x000001A1344E0000-memory.dmp

Filesize
64KB

Download
memory/4904-52-0x000001A1344C0000-0x000001A1344D0000-memory.dmp

Filesize
64KB

Download
memory/4904-56-0x000001A1344E0000-0x000001A1344F0000-memory.dmp

Filesize
64KB

Download
memory/4904-58-0x000001A134450000-0x000001A134460000-memory.dmp

Filesize
64KB

Download
memory/4904-59-0x000001A1344F0000-0x000001A134500000-memory.dmp

Filesize
64KB

Download
memory/4904-61-0x000001A134460000-0x000001A134470000-memory.dmp

Filesize
64KB

Download
memory/4904-62-0x000001A134500000-0x000001A134510000-memory.dmp

Filesize
64KB

Download
memory/4904-65-0x000001A134510000-0x000001A134520000-memory.dmp

Filesize
64KB

Download
memory/4904-64-0x000001A134470000-0x000001A134480000-memory.dmp

Filesize
64KB

Download
memory/4904-71-0x000001A134520000-0x000001A134530000-memory.dmp

Filesize
64KB

Download
memory/4904-70-0x000001A134480000-0x000001A134490000-memory.dmp

Filesize
64KB

Download
memory/4904-75-0x000001A134490000-0x000001A1344A0000-memory.dmp

Filesize
64KB

Download
memory/4904-77-0x000001A134530000-0x000001A134540000-memory.dmp

Filesize
64KB

Download
memory/4904-79-0x000001A134540000-0x000001A134550000-memory.dmp

Filesize
64KB

Download
memory/4904-78-0x000001A1344A0000-0x000001A1344B0000-memory.dmp

Filesize
64KB

Download
memory/4904-80-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-83-0x000001A134550000-0x000001A134560000-memory.dmp

Filesize
64KB

Download
memory/4904-82-0x000001A1344B0000-0x000001A1344C0000-memory.dmp

Filesize
64KB

Download
memory/4904-87-0x000001A134560000-0x000001A134570000-memory.dmp

Filesize
64KB

Download
memory/4904-86-0x000001A1344D0000-0x000001A1344E0000-memory.dmp

Filesize
64KB

Download
memory/4904-85-0x000001A1344C0000-0x000001A1344D0000-memory.dmp

Filesize
64KB

Download
memory/4904-89-0x000001A134570000-0x000001A134580000-memory.dmp

Filesize
64KB

Download
memory/4904-92-0x000001A134580000-0x000001A134590000-memory.dmp

Filesize
64KB

Download
memory/4904-91-0x000001A1344E0000-0x000001A1344F0000-memory.dmp

Filesize
64KB

Download
memory/4904-96-0x000001A134590000-0x000001A1345A0000-memory.dmp

Filesize
64KB

Download
memory/4904-95-0x000001A1344F0000-0x000001A134500000-memory.dmp

Filesize
64KB

Download
memory/4904-98-0x000001A1345A0000-0x000001A1345B0000-memory.dmp

Filesize
64KB

Download
memory/4904-97-0x000001A134500000-0x000001A134510000-memory.dmp

Filesize
64KB

Download
memory/4904-101-0x000001A1345B0000-0x000001A1345C0000-memory.dmp

Filesize
64KB

Download
memory/4904-100-0x000001A134510000-0x000001A134520000-memory.dmp

Filesize
64KB

Download
memory/4904-105-0x000001A134530000-0x000001A134540000-memory.dmp

Filesize
64KB

Download
memory/4904-104-0x000001A134520000-0x000001A134530000-memory.dmp

Filesize
64KB

Download
memory/4904-106-0x000001A1345C0000-0x000001A1345D0000-memory.dmp

Filesize
64KB

Download
memory/4904-113-0x000001A134540000-0x000001A134550000-memory.dmp

Filesize
64KB

Download
memory/4904-115-0x000001A134550000-0x000001A134560000-memory.dmp

Filesize
64KB

Download
memory/4904-116-0x000001A134560000-0x000001A134570000-memory.dmp

Filesize
64KB

Download
memory/4904-122-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-123-0x000001A134570000-0x000001A134580000-memory.dmp

Filesize
64KB

Download
memory/4904-127-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-129-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-144-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-143-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-156-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-168-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-182-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-190-0x000001A132A00000-0x000001A132A01000-memory.dmp

Filesize
4KB

Download
memory/4904-299-0x000001A134580000-0x000001A134590000-memory.dmp

Filesize
64KB

Download
memory/4904-318-0x000001A134590000-0x000001A1345A0000-memory.dmp

Filesize
64KB

Download
memory/4904-321-0x000001A1345A0000-0x000001A1345B0000-memory.dmp

Filesize
64KB

Download
memory/4904-323-0x000001A1345B0000-0x000001A1345C0000-memory.dmp

Filesize
64KB

Download
memory/4904-362-0x000001A1345C0000-0x000001A1345D0000-memory.dmp

Filesize
64KB

Download