darkcomet | 453976d3f2a82bb38764809e037bd2cb845a3e190d0de31d7c145fc9d6fc5246

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2025, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Size

749KB
MD5

33ecc627f63b589e7ff67c248d1ec3cf
SHA1

8a2a93ff1553cf2450c9eca7842d8b118b5554a5
SHA256

453976d3f2a82bb38764809e037bd2cb845a3e190d0de31d7c145fc9d6fc5246
SHA512

5636ac89275f9faa37c25aea1fd0216e493a637e9635361e4575429ee06875441b44b6f8f236d427577f22fa24d3caef8ec4f9499bc1adf27e049869156f6632
SSDEEP

12288:5wnH/+HdB63tW/xWp2yS2Y+WiB2R4phHNWVXwGnT9E4ysep+YVtVFQ/f3Fz:iHKdcW5H2Y+WiB2RCWtxT9EnsfYVtTQH

Score

10^/10

darkcomet guest16 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

freakyland.no-ip.biz:84

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
$z2GzzGzm=iD
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3784 set thread context of 3520	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeSecurityPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeTakeOwnershipPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeLoadDriverPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeSystemProfilePrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeSystemtimePrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeProfSingleProcessPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeIncBasePriorityPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeCreatePagefilePrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeBackupPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeRestorePrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeShutdownPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeDebugPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeSystemEnvironmentPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeChangeNotifyPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeRemoteShutdownPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeUndockPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeManageVolumePrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeImpersonatePrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeCreateGlobalPrivilege	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: 33	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: 34	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: 35	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: 36	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
Token: SeIncreaseQuotaPrivilege	3520	explorer.exe
Token: SeSecurityPrivilege	3520	explorer.exe
Token: SeTakeOwnershipPrivilege	3520	explorer.exe
Token: SeLoadDriverPrivilege	3520	explorer.exe
Token: SeSystemProfilePrivilege	3520	explorer.exe
Token: SeSystemtimePrivilege	3520	explorer.exe
Token: SeProfSingleProcessPrivilege	3520	explorer.exe
Token: SeIncBasePriorityPrivilege	3520	explorer.exe
Token: SeCreatePagefilePrivilege	3520	explorer.exe
Token: SeBackupPrivilege	3520	explorer.exe
Token: SeRestorePrivilege	3520	explorer.exe
Token: SeShutdownPrivilege	3520	explorer.exe
Token: SeDebugPrivilege	3520	explorer.exe
Token: SeSystemEnvironmentPrivilege	3520	explorer.exe
Token: SeChangeNotifyPrivilege	3520	explorer.exe
Token: SeRemoteShutdownPrivilege	3520	explorer.exe
Token: SeUndockPrivilege	3520	explorer.exe
Token: SeManageVolumePrivilege	3520	explorer.exe
Token: SeImpersonatePrivilege	3520	explorer.exe
Token: SeCreateGlobalPrivilege	3520	explorer.exe
Token: 33	3520	explorer.exe
Token: 34	3520	explorer.exe
Token: 35	3520	explorer.exe
Token: 36	3520	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3520	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe	86
PID 3784 wrote to memory of 3520	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe	86
PID 3784 wrote to memory of 3520	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe	86
PID 3784 wrote to memory of 3520	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe	86
PID 3784 wrote to memory of 3520	3784	JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_33ecc627f63b589e7ff67c248d1ec3cf.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Checks BIOS information in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
85a04b9f781bb919cc2b45b8c386177f

SHA1
799744a0938f204e91a303c0c6ddca5cdea6f861

SHA256
e91c804bd011735f3679cb7f3a8959835d80df2bbc8bfdb03837c7358b8defdb

SHA512
a422a2e28cf4a2526e924aa179bb68a951b75fe18de9ccfe8c81d6d1a46499beee3229c05797fd7c0f5e750a37481f1ee4d5696931cc1b8e10a264131c84e17a

Download Submit
C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
98ab3951c88f68823077a9779b70fb19

SHA1
53893f8ed7c143b2803652ec9dd53d58c0c67484

SHA256
68654d015966ec1fb538a38898942bbdb02410b186865c9ca60affb0a5488236

SHA512
083c162728e0c4a28b31d9f1b0af2bfa06887a1670ec3e0c350541b4e3485d0cbf85958d5da3cd0912c52f81e2fe58158a1e6db8fc98b874d9352781840cd6ca

Download Submit
memory/3520-13-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3520-15-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3520-28-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3520-14-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3520-31-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3520-34-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/3520-33-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3520-32-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3520-35-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3784-0-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/3784-12-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/3784-30-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads