darkcomet | 0c07452276e5f1aeb9141838ba111082f26d649e367260bcac79e7a53c87abe7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
Size

1.1MB
MD5

473bb96535577da629bae8d844609fd8
SHA1

be59020bdd323d2c75f2103779a955439536127e
SHA256

0c07452276e5f1aeb9141838ba111082f26d649e367260bcac79e7a53c87abe7
SHA512

7188f0348c48bfe804774299685e1f23374f1d849e329f00869881bd7428ac905a4142c4d68651107f3189cd32a860e90c36f26a8fed9903bea1e9333a4b9be2
SSDEEP

24576:1pXSPXBknXGancJS9w5vpzcI3qP4SRmVQ:aPX9JSeBz6P4BV

Score

10^/10

darkcomet hawkeye zombie discovery keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

sukui.zapto.org:81

Mutex

DC_MUTEX-PWN56G3

Attributes

gencode
jsCmksSUB�Uk
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	audiodgi.exe

Deletes itself 1 IoCs

pid	Process
1172	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
1172	svchost.exe
3696	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1680	wmpmetwk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe"	audiodgi.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 3696	1172	svchost.exe	91
PID 4684 set thread context of 1680	4684	wmpmetwk.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpmetwk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpmetwk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
4684	wmpmetwk.exe
1172	svchost.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe
1884	audiodgi.exe
4684	wmpmetwk.exe
1172	svchost.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
Token: SeDebugPrivilege	1172	svchost.exe
Token: SeIncreaseQuotaPrivilege	3696	svchost.exe
Token: SeSecurityPrivilege	3696	svchost.exe
Token: SeTakeOwnershipPrivilege	3696	svchost.exe
Token: SeLoadDriverPrivilege	3696	svchost.exe
Token: SeSystemProfilePrivilege	3696	svchost.exe
Token: SeSystemtimePrivilege	3696	svchost.exe
Token: SeProfSingleProcessPrivilege	3696	svchost.exe
Token: SeIncBasePriorityPrivilege	3696	svchost.exe
Token: SeCreatePagefilePrivilege	3696	svchost.exe
Token: SeBackupPrivilege	3696	svchost.exe
Token: SeRestorePrivilege	3696	svchost.exe
Token: SeShutdownPrivilege	3696	svchost.exe
Token: SeDebugPrivilege	3696	svchost.exe
Token: SeSystemEnvironmentPrivilege	3696	svchost.exe
Token: SeChangeNotifyPrivilege	3696	svchost.exe
Token: SeRemoteShutdownPrivilege	3696	svchost.exe
Token: SeUndockPrivilege	3696	svchost.exe
Token: SeManageVolumePrivilege	3696	svchost.exe
Token: SeImpersonatePrivilege	3696	svchost.exe
Token: SeCreateGlobalPrivilege	3696	svchost.exe
Token: 33	3696	svchost.exe
Token: 34	3696	svchost.exe
Token: 35	3696	svchost.exe
Token: 36	3696	svchost.exe
Token: SeDebugPrivilege	1884	audiodgi.exe
Token: SeDebugPrivilege	4684	wmpmetwk.exe
Token: SeIncreaseQuotaPrivilege	1680	wmpmetwk.exe
Token: SeSecurityPrivilege	1680	wmpmetwk.exe
Token: SeTakeOwnershipPrivilege	1680	wmpmetwk.exe
Token: SeLoadDriverPrivilege	1680	wmpmetwk.exe
Token: SeSystemProfilePrivilege	1680	wmpmetwk.exe
Token: SeSystemtimePrivilege	1680	wmpmetwk.exe
Token: SeProfSingleProcessPrivilege	1680	wmpmetwk.exe
Token: SeIncBasePriorityPrivilege	1680	wmpmetwk.exe
Token: SeCreatePagefilePrivilege	1680	wmpmetwk.exe
Token: SeBackupPrivilege	1680	wmpmetwk.exe
Token: SeRestorePrivilege	1680	wmpmetwk.exe
Token: SeShutdownPrivilege	1680	wmpmetwk.exe
Token: SeDebugPrivilege	1680	wmpmetwk.exe
Token: SeSystemEnvironmentPrivilege	1680	wmpmetwk.exe
Token: SeChangeNotifyPrivilege	1680	wmpmetwk.exe
Token: SeRemoteShutdownPrivilege	1680	wmpmetwk.exe
Token: SeUndockPrivilege	1680	wmpmetwk.exe
Token: SeManageVolumePrivilege	1680	wmpmetwk.exe
Token: SeImpersonatePrivilege	1680	wmpmetwk.exe
Token: SeCreateGlobalPrivilege	1680	wmpmetwk.exe
Token: 33	1680	wmpmetwk.exe
Token: 34	1680	wmpmetwk.exe
Token: 35	1680	wmpmetwk.exe
Token: 36	1680	wmpmetwk.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1172	3236	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe	90
PID 3236 wrote to memory of 1172	3236	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe	90
PID 3236 wrote to memory of 1172	3236	JaffaCakes118_473bb96535577da629bae8d844609fd8.exe	90
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 3696	1172	svchost.exe	91
PID 1172 wrote to memory of 1884	1172	svchost.exe	92
PID 1172 wrote to memory of 1884	1172	svchost.exe	92
PID 1172 wrote to memory of 1884	1172	svchost.exe	92
PID 1884 wrote to memory of 4684	1884	audiodgi.exe	93
PID 1884 wrote to memory of 4684	1884	audiodgi.exe	93
PID 1884 wrote to memory of 4684	1884	audiodgi.exe	93
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94
PID 4684 wrote to memory of 1680	4684	wmpmetwk.exe	94

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_473bb96535577da629bae8d844609fd8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_473bb96535577da629bae8d844609fd8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
    "C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
      "C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
        
        C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
10b61f5753e8a5848b4f99d93fba0208

SHA1
b547eaeefda793e4d62758e219f3430ed77085a8

SHA256
58f2cc39c85b4cdcb280437b421d415b630ac1baf05ed54eed135d85d68f7f07

SHA512
4c90aefa5453d36fbef1e4b6efff8504a0f2b8ec5221247e2df6698f6aa5d5f91c494d6c093adb2538f710dd8eb7f51052b85061bd16e4dd28bbddf08afffaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

Filesize
10KB

MD5
83ce94edcf6b43e60e467a9f22705d3e

SHA1
0a3738cbee68a53e8d5e93f83d5b633f8ae95232

SHA256
558224443ed55cc3efc377ff06ba86ef2d4c910da4d3d47c590377c487c1d63f

SHA512
51675f7143d6666452dc231ffc03e0dab642f2c2c8a3d61dc567beec825ea52d45513243ea81d3873d44a66b8d7a1340f0b6e5ecac741c29d01813de8631d383

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.1MB

MD5
473bb96535577da629bae8d844609fd8

SHA1
be59020bdd323d2c75f2103779a955439536127e

SHA256
0c07452276e5f1aeb9141838ba111082f26d649e367260bcac79e7a53c87abe7

SHA512
7188f0348c48bfe804774299685e1f23374f1d849e329f00869881bd7428ac905a4142c4d68651107f3189cd32a860e90c36f26a8fed9903bea1e9333a4b9be2

Download Submit
memory/1172-17-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/1172-18-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/1172-37-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3236-0-0x0000000074B52000-0x0000000074B53000-memory.dmp

Filesize
4KB

Download
memory/3236-2-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3236-19-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3236-1-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3696-23-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3696-25-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3696-26-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3696-27-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/3696-29-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3696-28-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download