darkcomet | e24e84e489dc371381cf78e075e20624af7c13340ba44018756a1492a5d09785

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe
Size 554KB
Sample260915-t2seqazfpb
SHA256 e24e84e489dc371381cf78e075e20624af7c13340ba44018756a1492a5d09785
MD5 e683ccc41e89b4119df6893655ee47d3
SHA1 fac9236d4fbe875ba25d0d2ac97fb1674ff4110a
SHA512 d61631eac82da54c5158fde8dbcba3871112936e330e4e5a78a2e41f5126745869c98b16960e3310dac3db5063bee6a2ea07acf62babbd5529aec0fbc6ed0881
SSDEEP 12288:b0endYZO8AQSOLYpDH9pC7hSU+VaojHHna5MDoykspG9WMpVFEQqV:JndQO9QQH4hScwnnalscZhE
TLSH
T1C8C41203BA479332CDBC513694DB215903F4AF9F277396583D2E314C6AA63A31F9AE44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darkcomet rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4392 set thread context of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	1008	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87
PID 4392 wrote to memory of 1008	4392	jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e683ccc41e89b4119df6893655ee47d3_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 672
    3⤵
    - Program crash
    PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1008 -ip 1008
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-3-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1008-4-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1008-5-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1008-6-0x0000000074B40000-0x000000007519C000-memory.dmp

Download

memory/1008-7-0x0000000074B40000-0x000000007519C000-memory.dmp

Download

memory/4392-0-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/4392-1-0x0000000074B72000-0x0000000074B74000-memory.dmp

Download

memory/4392-2-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads