darkcomet | 614debebea269ee73ff158fb9e4e0cbe1d7d4a0e5d1cf3fc9a8f8546fb00bd07

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/02/2025, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
Size

920KB
MD5

1e114210b93cef08783b38c1622b030b
SHA1

77b39bd584a2da176716d84f3059771845ecec68
SHA256

614debebea269ee73ff158fb9e4e0cbe1d7d4a0e5d1cf3fc9a8f8546fb00bd07
SHA512

345a3089786e58df7c998c329796a08e16a18d9cf0598c379d24e1f46538fe338af3c8d4350aa5062fedb224a559e321faa9b668f6963b6cfba2dec4e43e01d8
SSDEEP

24576:vqmmmmKwhie5gHgAqi315mN1B84FVT8p09:ArATmBZV

Score

10^/10

darkcomet guest16 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

sfacc51.zapto.org:783

Mutex

DC_MUTEX-280ADGN

Attributes

gencode
f5jNcjCFer-J
install
false
offline_keylogger
true
password
123
persistence
false

rc4.plain

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winhost32.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe

Executes dropped EXE 1 IoCs

pid	Process
2496	winhost32.exe

Loads dropped DLL 5 IoCs

pid	Process
2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhost32.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winhost32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winhost32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winhost32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winhost32.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winhost32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
Token: SeIncreaseQuotaPrivilege	2496	winhost32.exe
Token: SeSecurityPrivilege	2496	winhost32.exe
Token: SeTakeOwnershipPrivilege	2496	winhost32.exe
Token: SeLoadDriverPrivilege	2496	winhost32.exe
Token: SeSystemProfilePrivilege	2496	winhost32.exe
Token: SeSystemtimePrivilege	2496	winhost32.exe
Token: SeProfSingleProcessPrivilege	2496	winhost32.exe
Token: SeIncBasePriorityPrivilege	2496	winhost32.exe
Token: SeCreatePagefilePrivilege	2496	winhost32.exe
Token: SeBackupPrivilege	2496	winhost32.exe
Token: SeRestorePrivilege	2496	winhost32.exe
Token: SeShutdownPrivilege	2496	winhost32.exe
Token: SeDebugPrivilege	2496	winhost32.exe
Token: SeSystemEnvironmentPrivilege	2496	winhost32.exe
Token: SeChangeNotifyPrivilege	2496	winhost32.exe
Token: SeRemoteShutdownPrivilege	2496	winhost32.exe
Token: SeUndockPrivilege	2496	winhost32.exe
Token: SeManageVolumePrivilege	2496	winhost32.exe
Token: SeImpersonatePrivilege	2496	winhost32.exe
Token: SeCreateGlobalPrivilege	2496	winhost32.exe
Token: 33	2496	winhost32.exe
Token: 34	2496	winhost32.exe
Token: 35	2496	winhost32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2496	winhost32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30
PID 2256 wrote to memory of 2496	2256	JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e114210b93cef08783b38c1622b030b.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Roaming\winhost32.exe
  C:\Users\Admin\AppData\Roaming\winhost32.exe
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winhost32.exe

Filesize
16KB

MD5
c195458ced2b3d20337f9817d735f325

SHA1
c2783201e46f326fda77ebc5899a7959848a2d97

SHA256
024c2ba11fc8edeee6aa729e1c962ffaa1ed4c5997fed0ab868921f3a58fc2b2

SHA512
7db6a0b9a03ac099d7861f0cce6907d94f36b88d675b19e61a6646036287fdc8db91568403b76cb4be41558812e42bec822db43af7ff7c3474809e4d4fe4340e

Download Submit
\Users\Admin\AppData\Local\Temp\SystmCore.dll

Filesize
14KB

MD5
9a52fa5c6808030bb7da38600efd120b

SHA1
7169d46e1ba6615049e4672218aad8df5d8dc51c

SHA256
49fd0e58f38e168384ab018ecee80306ac15232caec842e9f4554c8092593483

SHA512
7563fe497bc254f86460a3704b2c090b85b8c9b0926b8835301e6a09626c2b6492eb764771dcf56c4902d34789566756aa60369377d9c2a57d5fbb24e955127a

Download Submit
memory/2256-1-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/2256-2-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/2256-47-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/2256-0-0x0000000074C81000-0x0000000074C82000-memory.dmp

Filesize
4KB

Download
memory/2496-42-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-21-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-29-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-27-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-26-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-24-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-33-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2496-40-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-19-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-43-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-46-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-45-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-44-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-37-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-41-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-39-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-31-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-48-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-49-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-50-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-51-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-52-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-53-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-54-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-55-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-56-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-57-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-58-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-59-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-60-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-61-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-62-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2496-63-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download