darkcomet | 60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 09:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9.exe
Size 983KB
Sample260924-lj4e9ssbrb
SHA256 60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9
MD5 82fddb3e0d0a408306bdee97aa288c90
SHA1 24200177481979a1448785e2f5fcee1c572683bb
SHA512 a441a8fccc612905bcb45217afca5f1d546192082b47e5b2cc32dd192caa5ade0622ff29d3fcb9c4fa58ea7db28fbccda2bebf35c6db28233c6cb9e57b8f017d
SSDEEP 24576:tYY9nClUFFZpM/OOtc11Cl5+tgAQO5rjTBOzifaKMHkwk3:NnCyHUm51AlktUA3TQzifrT3
TLSH
T19825233A469B0A96D09CAFF7B5EA87C1D5BEC1FA3ED0ED16AAD79EC4415127301E10C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

guest16 defense_evasion discovery execution darkcomet persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:80

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
u.$%=W*tkKUB
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 3 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	server.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	server.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	server.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	server.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	server.exe

Executes dropped EXE 1 IoCs

pid	Process
1896	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winsock32 Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe"	jaffacakes118_60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	server.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	server.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1896	server.exe
Token: SeSecurityPrivilege	1896	server.exe
Token: SeTakeOwnershipPrivilege	1896	server.exe
Token: SeLoadDriverPrivilege	1896	server.exe
Token: SeSystemProfilePrivilege	1896	server.exe
Token: SeSystemtimePrivilege	1896	server.exe
Token: SeProfSingleProcessPrivilege	1896	server.exe
Token: SeIncBasePriorityPrivilege	1896	server.exe
Token: SeCreatePagefilePrivilege	1896	server.exe
Token: SeBackupPrivilege	1896	server.exe
Token: SeRestorePrivilege	1896	server.exe
Token: SeShutdownPrivilege	1896	server.exe
Token: SeDebugPrivilege	1896	server.exe
Token: SeSystemEnvironmentPrivilege	1896	server.exe
Token: SeChangeNotifyPrivilege	1896	server.exe
Token: SeRemoteShutdownPrivilege	1896	server.exe
Token: SeUndockPrivilege	1896	server.exe
Token: SeManageVolumePrivilege	1896	server.exe
Token: SeImpersonatePrivilege	1896	server.exe
Token: SeCreateGlobalPrivilege	1896	server.exe
Token: 33	1896	server.exe
Token: 34	1896	server.exe
Token: 35	1896	server.exe
Token: 36	1896	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1896	server.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1896	5104	jaffacakes118_60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9.exe	89
PID 5104 wrote to memory of 4080	5104	jaffacakes118_60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_60e1a4cc5a9eb157f260c333455773aa77ecf08a3d81ca4e2bc78af08fe7f9f9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\server.exe
  C:\Users\Admin\AppData\Local\Temp\server.exe
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sys90547.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 811KB
SHA256 5f9a01054c0227c79f476035fc8697bc818f16e57b9ec04ed4cf4ebf7a15c523
MD5 49d4b918b62de33eb559fd3dd6a50662
SHA1 ae6fa4d7f3f9ebf24201a231c1367c3fe78a84e7
SHA512 15b4ea6604e5df0907f748052c046e6c5056550110930253b48f05c695f8d4bddc5ef6e2556a28999cb28c574193e2e5b1fa4c7eabe44e936e01ef257ac066a3
SSDEEP 12288:9aAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgded:YAEENIq8XwyVPQclDq/+WnpsSed
TLSH
T120056D21F6409437D92136F4DC5AD3A958397F206D39984B3AFA3F1C6E3A283EC1519E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys90547.bat

Path C:\Users\Admin\AppData\Local\Temp\sys90547.bat
Size 331B
SHA256 80d6697e23be5f061c4338928ffbfbb0d7430a2efe5adaeae6c3c02063babf41
MD5 892182aa5fbcef00be439a2cfd6ee960
SHA1 b511a3dfae565d102d4ce9f9c12c5b7e2cf6edd3
SHA512 6eb4fa304eaf7acbc5259e50646068c5d2c6211bca33bd747cc91cb70b7ce8edb5cd48f213b930df8aec8adf510539675a037685379c329e1bf2cab4ca3f8646
TLSH
T19DE07DE64AB3AA0A1C04984F9536132FD0366C8C3F893F2E0210929C124044CF7C37C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-24-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-25-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-15-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/1896-19-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/1896-20-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-21-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-22-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-23-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-33-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-16-0x00000000004AC000-0x00000000004AE000-memory.dmp

Download

memory/1896-26-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-27-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-28-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-29-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-30-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-31-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1896-32-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/5104-14-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads