darkcomet | 930fd889a87d50b42e82aa16c43e8bd4d0000c902b0363a805da958e078d18b2

Analysis

max time kernel
105s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
Size

1.1MB
MD5

8487a4c848c6184be11f6387271b268d
SHA1

aa792c5d09e1ba1461022123a52f5d9937882745
SHA256

930fd889a87d50b42e82aa16c43e8bd4d0000c902b0363a805da958e078d18b2
SHA512

7f1a3632ee9151eb379ba149c316bf63da09630432e2adf050816a11f8cf6ebbe96dc8cc86f0077987b619863dbe893251002215ed66eee6585a5f941febf67c
SSDEEP

12288:3gQ+sz6KRaTsQQvSCH1q455w3fz4OhyscZuv96EP27N3x:3gyZAsQ2PNw374OswJP+F

Score

10^/10

darkcomet discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 5848 set thread context of 0	5848	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 3828	5848	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	89
PID 5848 wrote to memory of 3828	5848	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	89
PID 5848 wrote to memory of 3828	5848	JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8487a4c848c6184be11f6387271b268d.exe"
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5848-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/5848-1-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download