darkcomet | 00fd3ebe05097e9d7126bb0c341b45b7df3233c37d00350bb5da5de07caeebed

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/02/2025, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe
Size

5.3MB
MD5

3463cee1547a94d1b1cb953907ff986c
SHA1

357e395eeffe902743d6bdfcd54ebd4989ca60c3
SHA256

00fd3ebe05097e9d7126bb0c341b45b7df3233c37d00350bb5da5de07caeebed
SHA512

744f61ee3f85a1ae453a6cf0eb315eb44cb10ad16b411bd59c16bfbccd5b509aca37ff7e2eb38b4076ec3ba78df031cb1add05ec127bfe834f625e2baf3cac42
SSDEEP

98304:802MvuPcO8xoklmbET3aKE9cWdaMfoB5TF6i:801mPcOUpkEuZfQRB

Score

10^/10

darkcomet guest16_min discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16_min

elakosme.no-ip.info:1337

Mutex

DCMIN_MUTEX-TGESVUH

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
8TFZmGTvZDUn
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	svchost.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	FB_B922.tmp.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	IMDCSC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
1992	FB_B922.tmp.exe
3012	svchost.exe
2884	svchost.exe
2856	IMDCSC.exe
2600	svchost.exe
2564	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
2112	JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe
1992	FB_B922.tmp.exe
2884	svchost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\svchost.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2884	3012	svchost.exe	33
PID 2600 set thread context of 2564	2600	svchost.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB_B922.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2884	svchost.exe
Token: SeSecurityPrivilege	2884	svchost.exe
Token: SeTakeOwnershipPrivilege	2884	svchost.exe
Token: SeLoadDriverPrivilege	2884	svchost.exe
Token: SeSystemProfilePrivilege	2884	svchost.exe
Token: SeSystemtimePrivilege	2884	svchost.exe
Token: SeProfSingleProcessPrivilege	2884	svchost.exe
Token: SeIncBasePriorityPrivilege	2884	svchost.exe
Token: SeCreatePagefilePrivilege	2884	svchost.exe
Token: SeBackupPrivilege	2884	svchost.exe
Token: SeRestorePrivilege	2884	svchost.exe
Token: SeShutdownPrivilege	2884	svchost.exe
Token: SeDebugPrivilege	2884	svchost.exe
Token: SeSystemEnvironmentPrivilege	2884	svchost.exe
Token: SeChangeNotifyPrivilege	2884	svchost.exe
Token: SeRemoteShutdownPrivilege	2884	svchost.exe
Token: SeUndockPrivilege	2884	svchost.exe
Token: SeManageVolumePrivilege	2884	svchost.exe
Token: SeImpersonatePrivilege	2884	svchost.exe
Token: SeCreateGlobalPrivilege	2884	svchost.exe
Token: 33	2884	svchost.exe
Token: 34	2884	svchost.exe
Token: 35	2884	svchost.exe
Token: SeIncreaseQuotaPrivilege	2564	svchost.exe
Token: SeSecurityPrivilege	2564	svchost.exe
Token: SeTakeOwnershipPrivilege	2564	svchost.exe
Token: SeLoadDriverPrivilege	2564	svchost.exe
Token: SeSystemProfilePrivilege	2564	svchost.exe
Token: SeSystemtimePrivilege	2564	svchost.exe
Token: SeProfSingleProcessPrivilege	2564	svchost.exe
Token: SeIncBasePriorityPrivilege	2564	svchost.exe
Token: SeCreatePagefilePrivilege	2564	svchost.exe
Token: SeBackupPrivilege	2564	svchost.exe
Token: SeRestorePrivilege	2564	svchost.exe
Token: SeShutdownPrivilege	2564	svchost.exe
Token: SeDebugPrivilege	2564	svchost.exe
Token: SeSystemEnvironmentPrivilege	2564	svchost.exe
Token: SeChangeNotifyPrivilege	2564	svchost.exe
Token: SeRemoteShutdownPrivilege	2564	svchost.exe
Token: SeUndockPrivilege	2564	svchost.exe
Token: SeManageVolumePrivilege	2564	svchost.exe
Token: SeImpersonatePrivilege	2564	svchost.exe
Token: SeCreateGlobalPrivilege	2564	svchost.exe
Token: 33	2564	svchost.exe
Token: 34	2564	svchost.exe
Token: 35	2564	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	svchost.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1992	2112	JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe	30
PID 2112 wrote to memory of 1992	2112	JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe	30
PID 2112 wrote to memory of 1992	2112	JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe	30
PID 2112 wrote to memory of 1992	2112	JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe	30
PID 1992 wrote to memory of 3012	1992	FB_B922.tmp.exe	31
PID 1992 wrote to memory of 3012	1992	FB_B922.tmp.exe	31
PID 1992 wrote to memory of 3012	1992	FB_B922.tmp.exe	31
PID 1992 wrote to memory of 3012	1992	FB_B922.tmp.exe	31
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 3012 wrote to memory of 2884	3012	svchost.exe	33
PID 2884 wrote to memory of 2856	2884	svchost.exe	34
PID 2884 wrote to memory of 2856	2884	svchost.exe	34
PID 2884 wrote to memory of 2856	2884	svchost.exe	34
PID 2884 wrote to memory of 2856	2884	svchost.exe	34
PID 2856 wrote to memory of 2600	2856	IMDCSC.exe	35
PID 2856 wrote to memory of 2600	2856	IMDCSC.exe	35
PID 2856 wrote to memory of 2600	2856	IMDCSC.exe	35
PID 2856 wrote to memory of 2600	2856	IMDCSC.exe	35
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36
PID 2600 wrote to memory of 2564	2600	svchost.exe	36

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3463cee1547a94d1b1cb953907ff986c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\FB_B922.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\FB_B922.tmp.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
    C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
      C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
        
        "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2856
      - C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
        
        C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif

Filesize
731KB

MD5
9d9b12ba73a647c2e11c58307f15584d

SHA1
0385a338203879218739ed86d2cd273c0ce0afcd

SHA256
e9fbe8f68c76e9b905582b4c290b69abe33f17d4f66b4898dafeb77ac0003107

SHA512
d7dba1fcdac23d0481a3ff42d09028515c9066f72a063a988c1cae099a4cb86746ca2c882784c62ac84ecf57180c0bc44485192cdcc7beb9c249b843bdd75bb1

Download Submit
\Users\Admin\AppData\Local\Temp\FB_B922.tmp.exe

Filesize
731KB

MD5
9bf460199742183ffd234a7ab22f81a8

SHA1
c5f000925d2393e544469b1b018f1d61376f859e

SHA256
77bdf1779ca31524db1bcb9bb9c5ec098cff0b12c8c51803315303c2895c2277

SHA512
2be019065ded3f0e4ae58df042931748993063b65803921bfb9939f45379e5ac817f1ca644607dae7bfc051f702bc00c4db67156bab560d016eec408a7250d11

Download Submit
memory/1992-10-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2564-97-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-96-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-105-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-104-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-103-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-102-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-101-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-100-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-99-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-98-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-95-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-94-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-93-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-92-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-90-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-89-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2564-91-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-46-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-47-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2884-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-44-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-38-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-45-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-34-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2884-36-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads