darkcomet | 930fd889a87d50b42e82aa16c43e8bd4d0000c902b0363a805da958e078d18b2

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Size

1.1MB
MD5

8487a4c848c6184be11f6387271b268d
SHA1

aa792c5d09e1ba1461022123a52f5d9937882745
SHA256

930fd889a87d50b42e82aa16c43e8bd4d0000c902b0363a805da958e078d18b2
SHA512

7f1a3632ee9151eb379ba149c316bf63da09630432e2adf050816a11f8cf6ebbe96dc8cc86f0077987b619863dbe893251002215ed66eee6585a5f941febf67c
SSDEEP

12288:3gQ+sz6KRaTsQQvSCH1q455w3fz4OhyscZuv96EP27N3x:3gyZAsQ2PNw374OswJP+F

Score

10^/10

darkcomet guest16 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

kyozaml.no-ip.biz:1604

Mutex

DC_MUTEX-US91K5C

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
b-4hNN*wqDPY
install
true
offline_keylogger
true
persistence
false
reg_key
winupdater

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2484 set thread context of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 1860 set thread context of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 2796 set thread context of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2624 set thread context of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2228 set thread context of 2788	2228	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	40
PID 2788 set thread context of 2932	2788	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	42
PID 2932 set thread context of 1108	2932	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	44
PID 1108 set thread context of 2576	1108	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	46
PID 2576 set thread context of 1880	2576	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	48
PID 1880 set thread context of 2516	1880	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	50
PID 2516 set thread context of 1048	2516	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	52

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2156	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	30
PID 2484 wrote to memory of 2156	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	30
PID 2484 wrote to memory of 2156	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	30
PID 2484 wrote to memory of 2156	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	30
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 2484 wrote to memory of 1860	2484	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	31
PID 1860 wrote to memory of 2340	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	33
PID 1860 wrote to memory of 2340	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	33
PID 1860 wrote to memory of 2340	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	33
PID 1860 wrote to memory of 2340	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	33
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 1860 wrote to memory of 2796	1860	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	34
PID 2796 wrote to memory of 2336	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	35
PID 2796 wrote to memory of 2336	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	35
PID 2796 wrote to memory of 2336	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	35
PID 2796 wrote to memory of 2336	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	35
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2796 wrote to memory of 2624	2796	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	36
PID 2624 wrote to memory of 2608	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	37
PID 2624 wrote to memory of 2608	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	37
PID 2624 wrote to memory of 2608	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	37
PID 2624 wrote to memory of 2608	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	37
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38
PID 2624 wrote to memory of 2228	2624	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	38

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe"
  2⤵
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        6⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        6⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        7⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        8⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        8⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        9⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        9⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        10⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        10⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        11⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        11⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        12⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
        13⤵
        
        PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-5-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-4-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-2-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-29-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1860-9-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-8-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-1-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-7-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-11-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1860-6-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/1860-3-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2484-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2484-10-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2624-49-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2796-30-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2796-48-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads