darkcomet | 713baa14b06fb90966d7b95473d7b7a9feeb5187d150ae20b87b5222bd32c388

Analysis

max time kernel
88s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Size

648KB
MD5

9448ded73eeb994a3c104f532f9b3f95
SHA1

2f9f1bb5668b00bda86f25ae512cde6fe02c1a9f
SHA256

713baa14b06fb90966d7b95473d7b7a9feeb5187d150ae20b87b5222bd32c388
SHA512

6ffabf87fe5b567a162800ecb0ce3109148ac37ad5a1133c3c00dc92a47bed837d6af5b357b33aa45d95c8fd6544367695a941becdd2546de0e121c916ad7696
SSDEEP

12288:M6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhi:BAmBpVKHu0Mu9Xo20VGLVP5i

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

dasdasasd.no-ip.biz:555

Mutex

DC_MUTEX-91DFCMZ

Attributes

InstallPath
WindowsUpdater\FirefoxUpdater.exe
gencode
UejXcvDgj2s=
install
true
offline_keylogger
true
password
xxxxxx
persistence
true
reg_key
FirefoxUpdater

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdater\\FirefoxUpdater.exe"	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe

Executes dropped EXE 1 IoCs

pid	Process
3460	FirefoxUpdater.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FirefoxUpdater = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdater\\FirefoxUpdater.exe"	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FirefoxUpdater = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdater\\FirefoxUpdater.exe"	FirefoxUpdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FirefoxUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2468	cmd.exe
1920	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1920	PING.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeSecurityPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeTakeOwnershipPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeLoadDriverPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeSystemProfilePrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeSystemtimePrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeProfSingleProcessPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeIncBasePriorityPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeCreatePagefilePrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeBackupPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeRestorePrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeShutdownPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeDebugPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeSystemEnvironmentPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeChangeNotifyPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeRemoteShutdownPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeUndockPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeManageVolumePrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeImpersonatePrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeCreateGlobalPrivilege	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: 33	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: 34	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: 35	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: 36	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
Token: SeIncreaseQuotaPrivilege	3460	FirefoxUpdater.exe
Token: SeSecurityPrivilege	3460	FirefoxUpdater.exe
Token: SeTakeOwnershipPrivilege	3460	FirefoxUpdater.exe
Token: SeLoadDriverPrivilege	3460	FirefoxUpdater.exe
Token: SeSystemProfilePrivilege	3460	FirefoxUpdater.exe
Token: SeSystemtimePrivilege	3460	FirefoxUpdater.exe
Token: SeProfSingleProcessPrivilege	3460	FirefoxUpdater.exe
Token: SeIncBasePriorityPrivilege	3460	FirefoxUpdater.exe
Token: SeCreatePagefilePrivilege	3460	FirefoxUpdater.exe
Token: SeBackupPrivilege	3460	FirefoxUpdater.exe
Token: SeRestorePrivilege	3460	FirefoxUpdater.exe
Token: SeShutdownPrivilege	3460	FirefoxUpdater.exe
Token: SeDebugPrivilege	3460	FirefoxUpdater.exe
Token: SeSystemEnvironmentPrivilege	3460	FirefoxUpdater.exe
Token: SeChangeNotifyPrivilege	3460	FirefoxUpdater.exe
Token: SeRemoteShutdownPrivilege	3460	FirefoxUpdater.exe
Token: SeUndockPrivilege	3460	FirefoxUpdater.exe
Token: SeManageVolumePrivilege	3460	FirefoxUpdater.exe
Token: SeImpersonatePrivilege	3460	FirefoxUpdater.exe
Token: SeCreateGlobalPrivilege	3460	FirefoxUpdater.exe
Token: 33	3460	FirefoxUpdater.exe
Token: 34	3460	FirefoxUpdater.exe
Token: 35	3460	FirefoxUpdater.exe
Token: 36	3460	FirefoxUpdater.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	FirefoxUpdater.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3460	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe	88
PID 4996 wrote to memory of 3460	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe	88
PID 4996 wrote to memory of 3460	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe	88
PID 4996 wrote to memory of 2468	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe	89
PID 4996 wrote to memory of 2468	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe	89
PID 4996 wrote to memory of 2468	4996	JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe	89
PID 2468 wrote to memory of 1920	2468	cmd.exe	93
PID 2468 wrote to memory of 1920	2468	cmd.exe	93
PID 2468 wrote to memory of 1920	2468	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9448ded73eeb994a3c104f532f9b3f95.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:2284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:2908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:4484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:1832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:2640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:3004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:1208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdater\FirefoxUpdater.exe

Filesize
648KB

MD5
9448ded73eeb994a3c104f532f9b3f95

SHA1
2f9f1bb5668b00bda86f25ae512cde6fe02c1a9f

SHA256
713baa14b06fb90966d7b95473d7b7a9feeb5187d150ae20b87b5222bd32c388

SHA512
6ffabf87fe5b567a162800ecb0ce3109148ac37ad5a1133c3c00dc92a47bed837d6af5b357b33aa45d95c8fd6544367695a941becdd2546de0e121c916ad7696

Download Submit
memory/3460-17-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-19-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-26-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-14-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-16-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-25-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-11-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3460-20-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-22-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-23-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3460-24-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4996-0-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/4996-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads