darkcomet | 29ea67ac4f8e522ee278fb995241bdbf780005e3190d12cd42ccdbb1ecadd609

Analysis

max time kernel
46s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
13/03/2025, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Size

675KB
MD5

6dfecabd3ed5504ca681d60289d4d2ed
SHA1

d58b5aa3074fb463c103f01223d8b4d5e2f1a9ea
SHA256

29ea67ac4f8e522ee278fb995241bdbf780005e3190d12cd42ccdbb1ecadd609
SHA512

942a005f06631d3c339fe06ab1823dde6742627281fa6b93bf68b1e1e952b5d251e3e50fff4a1a026342cd886745945f3ada1f6efec0e0c44875b9af2046fa69
SSDEEP

12288:2YsBjyu2VYSeyReBbZJdZEBl9Ye0/lm82dy9toTY7W2H7hVzCrDYkjU:uhykPyMZdZw90dv2s9toMWu9VzCXVU

Score

10^/10

darkcomet latentbot guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

stevecarl2010.zapto.org:5900

Mutex

DC_MUTEX-8Z6T4JY

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
MhjElth#fkUo
install
true
offline_keylogger
true
persistence
false
reg_key
winupdater

rc4.plain

Extracted

Family

latentbot

stevecarl2010.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	winupdate.exe

Loads dropped DLL 4 IoCs

pid	Process
2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
2536	winupdate.exe
2536	winupdate.exe
2536	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 2944	2536	winupdate.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeSecurityPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeTakeOwnershipPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeLoadDriverPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeSystemProfilePrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeSystemtimePrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeProfSingleProcessPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeIncBasePriorityPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeCreatePagefilePrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeBackupPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeRestorePrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeShutdownPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeDebugPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeSystemEnvironmentPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeChangeNotifyPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeRemoteShutdownPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeUndockPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeManageVolumePrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeImpersonatePrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeCreateGlobalPrivilege	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: 33	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: 34	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: 35	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
Token: SeIncreaseQuotaPrivilege	2536	winupdate.exe
Token: SeSecurityPrivilege	2536	winupdate.exe
Token: SeTakeOwnershipPrivilege	2536	winupdate.exe
Token: SeLoadDriverPrivilege	2536	winupdate.exe
Token: SeSystemProfilePrivilege	2536	winupdate.exe
Token: SeSystemtimePrivilege	2536	winupdate.exe
Token: SeProfSingleProcessPrivilege	2536	winupdate.exe
Token: SeIncBasePriorityPrivilege	2536	winupdate.exe
Token: SeCreatePagefilePrivilege	2536	winupdate.exe
Token: SeBackupPrivilege	2536	winupdate.exe
Token: SeRestorePrivilege	2536	winupdate.exe
Token: SeShutdownPrivilege	2536	winupdate.exe
Token: SeDebugPrivilege	2536	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2536	winupdate.exe
Token: SeChangeNotifyPrivilege	2536	winupdate.exe
Token: SeRemoteShutdownPrivilege	2536	winupdate.exe
Token: SeUndockPrivilege	2536	winupdate.exe
Token: SeManageVolumePrivilege	2536	winupdate.exe
Token: SeImpersonatePrivilege	2536	winupdate.exe
Token: SeCreateGlobalPrivilege	2536	winupdate.exe
Token: 33	2536	winupdate.exe
Token: 34	2536	winupdate.exe
Token: 35	2536	winupdate.exe
Token: SeIncreaseQuotaPrivilege	2944	iexplore.exe
Token: SeSecurityPrivilege	2944	iexplore.exe
Token: SeTakeOwnershipPrivilege	2944	iexplore.exe
Token: SeLoadDriverPrivilege	2944	iexplore.exe
Token: SeSystemProfilePrivilege	2944	iexplore.exe
Token: SeSystemtimePrivilege	2944	iexplore.exe
Token: SeProfSingleProcessPrivilege	2944	iexplore.exe
Token: SeIncBasePriorityPrivilege	2944	iexplore.exe
Token: SeCreatePagefilePrivilege	2944	iexplore.exe
Token: SeBackupPrivilege	2944	iexplore.exe
Token: SeRestorePrivilege	2944	iexplore.exe
Token: SeShutdownPrivilege	2944	iexplore.exe
Token: SeDebugPrivilege	2944	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2944	iexplore.exe
Token: SeChangeNotifyPrivilege	2944	iexplore.exe
Token: SeRemoteShutdownPrivilege	2944	iexplore.exe
Token: SeUndockPrivilege	2944	iexplore.exe
Token: SeManageVolumePrivilege	2944	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2536	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe	31
PID 2580 wrote to memory of 2536	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe	31
PID 2580 wrote to memory of 2536	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe	31
PID 2580 wrote to memory of 2536	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe	31
PID 2580 wrote to memory of 2536	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe	31
PID 2580 wrote to memory of 2536	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe	31
PID 2580 wrote to memory of 2536	2580	JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe	31
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32
PID 2536 wrote to memory of 2944	2536	winupdate.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dfecabd3ed5504ca681d60289d4d2ed.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windupdt\winupdate.exe
  "C:\Windupdt\winupdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windupdt\winupdate.exe

Filesize
675KB

MD5
6dfecabd3ed5504ca681d60289d4d2ed

SHA1
d58b5aa3074fb463c103f01223d8b4d5e2f1a9ea

SHA256
29ea67ac4f8e522ee278fb995241bdbf780005e3190d12cd42ccdbb1ecadd609

SHA512
942a005f06631d3c339fe06ab1823dde6742627281fa6b93bf68b1e1e952b5d251e3e50fff4a1a026342cd886745945f3ada1f6efec0e0c44875b9af2046fa69

Download Submit
memory/2536-29-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2536-25-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2536-26-0x0000000000520000-0x000000000063B000-memory.dmp

Filesize
1.1MB

Download
memory/2580-9-0x0000000003180000-0x0000000003181000-memory.dmp

Filesize
4KB

Download
memory/2580-4-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/2580-2-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download
memory/2580-0-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2580-1-0x0000000001D10000-0x0000000001D70000-memory.dmp

Filesize
384KB

Download
memory/2580-8-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/2580-10-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2580-3-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/2580-19-0x0000000001D10000-0x0000000001D70000-memory.dmp

Filesize
384KB

Download
memory/2580-18-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2580-5-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/2580-6-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2580-7-0x0000000001CE0000-0x0000000001CE1000-memory.dmp

Filesize
4KB

Download
memory/2944-27-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads