darkcomet | 451a02b69262853fb285e4ce0a07e13cc48a161ef84634ab38f27eef44974ad3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Size

869KB
MD5

7cc8c2f33bc298c9f83d2d32742c2018
SHA1

075a07d76f3a4489f5f07a9f724ef230ad249110
SHA256

451a02b69262853fb285e4ce0a07e13cc48a161ef84634ab38f27eef44974ad3
SHA512

56bb6e7a62dc3a1d6bd192d53529f7b620968209b2f9ba8a905deb04f977476ab41285ac25d18a610e11d4b0e2c42151ff94bb75db0e0fe57d43b46d5f57725e
SSDEEP

24576:FNlEmHpqig4M+Ul9EXypsOjPxIQpnG1Pcr6SN74:FNlEmJ0z7lKCpzjuQFG5gLNU

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

dudu2011.no-ip.org:1604

Mutex

DC_MUTEX-F54S21D

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
a5KD-sAPLHGv
install
true
offline_keylogger
true
persistence
true
reg_key
winupdater

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe

Executes dropped EXE 2 IoCs

pid	Process
1888	REGISTRATOR.EXE
4608	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGISTRATOR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4608	winupdate.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeSecurityPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeTakeOwnershipPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeLoadDriverPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeSystemProfilePrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeSystemtimePrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeProfSingleProcessPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeIncBasePriorityPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeCreatePagefilePrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeBackupPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeRestorePrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeShutdownPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeDebugPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeSystemEnvironmentPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeChangeNotifyPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeRemoteShutdownPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeUndockPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeManageVolumePrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeImpersonatePrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeCreateGlobalPrivilege	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: 33	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: 34	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: 35	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: 36	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
Token: SeIncreaseQuotaPrivilege	4608	winupdate.exe
Token: SeSecurityPrivilege	4608	winupdate.exe
Token: SeTakeOwnershipPrivilege	4608	winupdate.exe
Token: SeLoadDriverPrivilege	4608	winupdate.exe
Token: SeSystemProfilePrivilege	4608	winupdate.exe
Token: SeSystemtimePrivilege	4608	winupdate.exe
Token: SeProfSingleProcessPrivilege	4608	winupdate.exe
Token: SeIncBasePriorityPrivilege	4608	winupdate.exe
Token: SeCreatePagefilePrivilege	4608	winupdate.exe
Token: SeBackupPrivilege	4608	winupdate.exe
Token: SeRestorePrivilege	4608	winupdate.exe
Token: SeShutdownPrivilege	4608	winupdate.exe
Token: SeDebugPrivilege	4608	winupdate.exe
Token: SeSystemEnvironmentPrivilege	4608	winupdate.exe
Token: SeChangeNotifyPrivilege	4608	winupdate.exe
Token: SeRemoteShutdownPrivilege	4608	winupdate.exe
Token: SeUndockPrivilege	4608	winupdate.exe
Token: SeManageVolumePrivilege	4608	winupdate.exe
Token: SeImpersonatePrivilege	4608	winupdate.exe
Token: SeCreateGlobalPrivilege	4608	winupdate.exe
Token: 33	4608	winupdate.exe
Token: 34	4608	winupdate.exe
Token: 35	4608	winupdate.exe
Token: 36	4608	winupdate.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1888	REGISTRATOR.EXE
1888	REGISTRATOR.EXE
4608	winupdate.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1888	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe	88
PID 632 wrote to memory of 1888	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe	88
PID 632 wrote to memory of 1888	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe	88
PID 632 wrote to memory of 4608	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe	89
PID 632 wrote to memory of 4608	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe	89
PID 632 wrote to memory of 4608	632	JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7cc8c2f33bc298c9f83d2d32742c2018.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\REGISTRATOR.EXE
  "C:\Users\Admin\AppData\Local\Temp\REGISTRATOR.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1888
- C:\Windupdt\winupdate.exe
  "C:\Windupdt\winupdate.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
5427eb024ee55d9639c6894f83476bbf

SHA1
1a4ed69fc88e91b21bf322183a31d98d685c27bc

SHA256
d271a81cb65ae373fc29a28a7b063969013b6ca08b8f50b9517d3eedb0368c42

SHA512
4bdf2d867c63523c36658ba634382544606e40f9601aa1fd34ba67b21990b1ffe4ba5a01da310c2f0dc65b10ae26695d8015ae15d227bb3f0072b01ea54b5fb3

Download Submit
C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
c4cac9d44b489c9ac3d19befe4395708

SHA1
85fb5c2c620b2cd9fce838e3730e13d5eda44961

SHA256
b95d019f09ec398bb66f13366bf5112b4134cc4f32b6a157effe95817b3857d3

SHA512
3b290836d5a60373b3ac191851325b6e120447a44f356169855bb1c64bc584a9508255345825acb17e5a8108c24d806d11d34ab9ed4e69e059ffac6e76d05aa3

Download Submit
C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
b63658ff73f6754a9b2247469d15be30

SHA1
6143a1b19edef4a6b5fcb23052963dd2efacf5da

SHA256
856de4e32eb640d22615bd12ec870dd7bb26d127837c4f19ddb6cbcb21f7c575

SHA512
be2c9784579130d34126442dee48a1ee5ed31b35e2e12bf0b639fbbd81a504ec5b84db790d319f7290f5da68601dc5a4aedd1d8fbc146cb3690ea202840bc876

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGISTRATOR.EXE

Filesize
55KB

MD5
0a107bbf138aaac2daeac73cb56f1e00

SHA1
f69675daf2c67688036ec60cf8170bab993b67f7

SHA256
71894e21a2d7ecd52ed8ee06c8634b5565cbe2cd7ca16305772c00af3a4e7efb

SHA512
67c5a09d14f36d7ee2d84ede5442a6555e8ccddfc2f20ed3978a5d977d6a0467cb1c215a1ea92f4b7508029d1cd20a20a1c847e4f2e520fe9059ed4b18d16099

Download Submit
C:\Windupdt\winupdate.exe

Filesize
869KB

MD5
7cc8c2f33bc298c9f83d2d32742c2018

SHA1
075a07d76f3a4489f5f07a9f724ef230ad249110

SHA256
451a02b69262853fb285e4ce0a07e13cc48a161ef84634ab38f27eef44974ad3

SHA512
56bb6e7a62dc3a1d6bd192d53529f7b620968209b2f9ba8a905deb04f977476ab41285ac25d18a610e11d4b0e2c42151ff94bb75db0e0fe57d43b46d5f57725e

Download Submit
memory/632-0-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/632-12-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/632-59-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-74-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-79-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-72-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-75-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-76-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-77-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-78-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-73-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-80-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-81-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-82-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-83-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-84-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-85-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4608-86-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads