darkcomet | b305e234e13edd0c620ac16b20773ad804b4ba442afcf60bf960a49626188fd3

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2025 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Size

746KB
MD5

0e7c3885267a33b9d70e83b42ee4eef0
SHA1

f3ef2dcdfe7c1d48eebfc6908b8f8c6d1830583f
SHA256

b305e234e13edd0c620ac16b20773ad804b4ba442afcf60bf960a49626188fd3
SHA512

806d0854ccc12ba3169eb3e7ab8b83630e5de9a87ac79edd39824c681be6e31210de4816ab4cc7143e03d5af7ccf553f54d07b48d19d2dbb2c10ee19a88a50f2
SSDEEP

12288:S6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhUsvv:XAmBpVKHu0Mu9Xo20VGLVP5vvv

Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-TM0AWX1

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
qZwwH6xTpa$s
install
true
offline_keylogger
false
persistence
false
reg_key
winupdater

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	winupdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe

Executes dropped EXE 1 IoCs

pid	Process
3584	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4888	cmd.exe
512	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
512	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3584	winupdate.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeSecurityPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeTakeOwnershipPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeLoadDriverPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeSystemProfilePrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeSystemtimePrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeProfSingleProcessPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeIncBasePriorityPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeCreatePagefilePrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeBackupPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeRestorePrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeShutdownPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeDebugPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeSystemEnvironmentPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeChangeNotifyPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeRemoteShutdownPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeUndockPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeManageVolumePrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeImpersonatePrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeCreateGlobalPrivilege	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: 33	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: 34	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: 35	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: 36	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
Token: SeIncreaseQuotaPrivilege	3584	winupdate.exe
Token: SeSecurityPrivilege	3584	winupdate.exe
Token: SeTakeOwnershipPrivilege	3584	winupdate.exe
Token: SeLoadDriverPrivilege	3584	winupdate.exe
Token: SeSystemProfilePrivilege	3584	winupdate.exe
Token: SeSystemtimePrivilege	3584	winupdate.exe
Token: SeProfSingleProcessPrivilege	3584	winupdate.exe
Token: SeIncBasePriorityPrivilege	3584	winupdate.exe
Token: SeCreatePagefilePrivilege	3584	winupdate.exe
Token: SeBackupPrivilege	3584	winupdate.exe
Token: SeRestorePrivilege	3584	winupdate.exe
Token: SeShutdownPrivilege	3584	winupdate.exe
Token: SeDebugPrivilege	3584	winupdate.exe
Token: SeSystemEnvironmentPrivilege	3584	winupdate.exe
Token: SeChangeNotifyPrivilege	3584	winupdate.exe
Token: SeRemoteShutdownPrivilege	3584	winupdate.exe
Token: SeUndockPrivilege	3584	winupdate.exe
Token: SeManageVolumePrivilege	3584	winupdate.exe
Token: SeImpersonatePrivilege	3584	winupdate.exe
Token: SeCreateGlobalPrivilege	3584	winupdate.exe
Token: 33	3584	winupdate.exe
Token: 34	3584	winupdate.exe
Token: 35	3584	winupdate.exe
Token: 36	3584	winupdate.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3584	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe	87
PID 1620 wrote to memory of 3584	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe	87
PID 1620 wrote to memory of 3584	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe	87
PID 1620 wrote to memory of 4888	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe	88
PID 1620 wrote to memory of 4888	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe	88
PID 1620 wrote to memory of 4888	1620	JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe	88
PID 4888 wrote to memory of 512	4888	cmd.exe	90
PID 4888 wrote to memory of 512	4888	cmd.exe	90
PID 4888 wrote to memory of 512	4888	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windupdt\winupdate.exe
  "C:\Windupdt\winupdate.exe"
  2⤵
  - Modifies security service
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e7c3885267a33b9d70e83b42ee4eef0.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windupdt\winupdate.exe

Filesize
746KB

MD5
0e7c3885267a33b9d70e83b42ee4eef0

SHA1
f3ef2dcdfe7c1d48eebfc6908b8f8c6d1830583f

SHA256
b305e234e13edd0c620ac16b20773ad804b4ba442afcf60bf960a49626188fd3

SHA512
806d0854ccc12ba3169eb3e7ab8b83630e5de9a87ac79edd39824c681be6e31210de4816ab4cc7143e03d5af7ccf553f54d07b48d19d2dbb2c10ee19a88a50f2

Download Submit
memory/1620-0-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1620-36-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3584-35-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/3584-37-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3584-38-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/3584-39-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3584-46-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3584-47-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads