darkcomet | 0c07452276e5f1aeb9141838ba111082f26d649e367260bcac79e7a53c87abe7

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03/03/2025, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
Size

1.1MB
MD5

473bb96535577da629bae8d844609fd8
SHA1

be59020bdd323d2c75f2103779a955439536127e
SHA256

0c07452276e5f1aeb9141838ba111082f26d649e367260bcac79e7a53c87abe7
SHA512

7188f0348c48bfe804774299685e1f23374f1d849e329f00869881bd7428ac905a4142c4d68651107f3189cd32a860e90c36f26a8fed9903bea1e9333a4b9be2
SSDEEP

24576:1pXSPXBknXGancJS9w5vpzcI3qP4SRmVQ:aPX9JSeBz6P4BV

Score

10^/10

darkcomet hawkeye zombie discovery keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

sukui.zapto.org:81

Mutex

DC_MUTEX-PWN56G3

Attributes

gencode
jsCmksSUB�Uk
install
false
offline_keylogger
false
persistence
false

rc4.plain

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Executes dropped EXE 5 IoCs

pid	Process
2116	svchost.exe
1452	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2852	wmpmetwk.exe

Loads dropped DLL 7 IoCs

pid	Process
1084	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
1084	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
2116	svchost.exe
2116	svchost.exe
2948	audiodgi.exe
2948	audiodgi.exe
2780	wmpmetwk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe"	audiodgi.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2116 set thread context of 1452	2116	svchost.exe	31
PID 2780 set thread context of 2852	2780	wmpmetwk.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpmetwk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpmetwk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe
2948	audiodgi.exe
2780	wmpmetwk.exe
2116	svchost.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
Token: SeDebugPrivilege	2116	svchost.exe
Token: SeDebugPrivilege	2948	audiodgi.exe
Token: SeIncreaseQuotaPrivilege	1452	svchost.exe
Token: SeSecurityPrivilege	1452	svchost.exe
Token: SeTakeOwnershipPrivilege	1452	svchost.exe
Token: SeLoadDriverPrivilege	1452	svchost.exe
Token: SeSystemProfilePrivilege	1452	svchost.exe
Token: SeSystemtimePrivilege	1452	svchost.exe
Token: SeProfSingleProcessPrivilege	1452	svchost.exe
Token: SeIncBasePriorityPrivilege	1452	svchost.exe
Token: SeCreatePagefilePrivilege	1452	svchost.exe
Token: SeBackupPrivilege	1452	svchost.exe
Token: SeRestorePrivilege	1452	svchost.exe
Token: SeShutdownPrivilege	1452	svchost.exe
Token: SeDebugPrivilege	1452	svchost.exe
Token: SeSystemEnvironmentPrivilege	1452	svchost.exe
Token: SeChangeNotifyPrivilege	1452	svchost.exe
Token: SeRemoteShutdownPrivilege	1452	svchost.exe
Token: SeUndockPrivilege	1452	svchost.exe
Token: SeManageVolumePrivilege	1452	svchost.exe
Token: SeImpersonatePrivilege	1452	svchost.exe
Token: SeCreateGlobalPrivilege	1452	svchost.exe
Token: 33	1452	svchost.exe
Token: 34	1452	svchost.exe
Token: 35	1452	svchost.exe
Token: SeDebugPrivilege	2780	wmpmetwk.exe
Token: SeIncreaseQuotaPrivilege	2852	wmpmetwk.exe
Token: SeSecurityPrivilege	2852	wmpmetwk.exe
Token: SeTakeOwnershipPrivilege	2852	wmpmetwk.exe
Token: SeLoadDriverPrivilege	2852	wmpmetwk.exe
Token: SeSystemProfilePrivilege	2852	wmpmetwk.exe
Token: SeSystemtimePrivilege	2852	wmpmetwk.exe
Token: SeProfSingleProcessPrivilege	2852	wmpmetwk.exe
Token: SeIncBasePriorityPrivilege	2852	wmpmetwk.exe
Token: SeCreatePagefilePrivilege	2852	wmpmetwk.exe
Token: SeBackupPrivilege	2852	wmpmetwk.exe
Token: SeRestorePrivilege	2852	wmpmetwk.exe
Token: SeShutdownPrivilege	2852	wmpmetwk.exe
Token: SeDebugPrivilege	2852	wmpmetwk.exe
Token: SeSystemEnvironmentPrivilege	2852	wmpmetwk.exe
Token: SeChangeNotifyPrivilege	2852	wmpmetwk.exe
Token: SeRemoteShutdownPrivilege	2852	wmpmetwk.exe
Token: SeUndockPrivilege	2852	wmpmetwk.exe
Token: SeManageVolumePrivilege	2852	wmpmetwk.exe
Token: SeImpersonatePrivilege	2852	wmpmetwk.exe
Token: SeCreateGlobalPrivilege	2852	wmpmetwk.exe
Token: 33	2852	wmpmetwk.exe
Token: 34	2852	wmpmetwk.exe
Token: 35	2852	wmpmetwk.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2116	1084	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe	30
PID 1084 wrote to memory of 2116	1084	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe	30
PID 1084 wrote to memory of 2116	1084	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe	30
PID 1084 wrote to memory of 2116	1084	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe	30
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 1452	2116	svchost.exe	31
PID 2116 wrote to memory of 2948	2116	svchost.exe	32
PID 2116 wrote to memory of 2948	2116	svchost.exe	32
PID 2116 wrote to memory of 2948	2116	svchost.exe	32
PID 2116 wrote to memory of 2948	2116	svchost.exe	32
PID 2948 wrote to memory of 2780	2948	audiodgi.exe	33
PID 2948 wrote to memory of 2780	2948	audiodgi.exe	33
PID 2948 wrote to memory of 2780	2948	audiodgi.exe	33
PID 2948 wrote to memory of 2780	2948	audiodgi.exe	33
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34
PID 2780 wrote to memory of 2852	2780	wmpmetwk.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_473bb96535577da629bae8d844609fd8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
    "C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
      "C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
        
        C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
10b61f5753e8a5848b4f99d93fba0208

SHA1
b547eaeefda793e4d62758e219f3430ed77085a8

SHA256
58f2cc39c85b4cdcb280437b421d415b630ac1baf05ed54eed135d85d68f7f07

SHA512
4c90aefa5453d36fbef1e4b6efff8504a0f2b8ec5221247e2df6698f6aa5d5f91c494d6c093adb2538f710dd8eb7f51052b85061bd16e4dd28bbddf08afffaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

Filesize
10KB

MD5
83ce94edcf6b43e60e467a9f22705d3e

SHA1
0a3738cbee68a53e8d5e93f83d5b633f8ae95232

SHA256
558224443ed55cc3efc377ff06ba86ef2d4c910da4d3d47c590377c487c1d63f

SHA512
51675f7143d6666452dc231ffc03e0dab642f2c2c8a3d61dc567beec825ea52d45513243ea81d3873d44a66b8d7a1340f0b6e5ecac741c29d01813de8631d383

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.1MB

MD5
473bb96535577da629bae8d844609fd8

SHA1
be59020bdd323d2c75f2103779a955439536127e

SHA256
0c07452276e5f1aeb9141838ba111082f26d649e367260bcac79e7a53c87abe7

SHA512
7188f0348c48bfe804774299685e1f23374f1d849e329f00869881bd7428ac905a4142c4d68651107f3189cd32a860e90c36f26a8fed9903bea1e9333a4b9be2

Download Submit
memory/1084-1-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1084-2-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1084-18-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/1084-0-0x0000000074621000-0x0000000074622000-memory.dmp

Filesize
4KB

Download
memory/1452-27-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-29-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-25-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-37-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-35-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1452-32-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-31-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-30-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-41-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-28-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-42-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-26-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1452-40-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2116-19-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/2116-20-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/2116-61-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/2852-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download