Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
15/10/2026, 04:10
General
- Target jaffacakes118_Backdoor.Win32.DarkKomet.aagt.exe
- Size 278KB
- Sample261015-ernlfsdx2j
- SHA256 d8f05d8442864e99810b1705ef7a2346bc54857792bfc5dd2bc6673aff51791f
Malware Config
Extracted
-
darkcomet
-
Guest16
-
testim123123.ddns.net:1604
-
DC_MUTEX-BAELG0Q
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
LBi81wYjsDo8
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies firewall policy service 3 TTPs 9 IoCs
- Modifies security service 2 TTPs 3 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- Disables RegEdit via registry modification 3 IoCs
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Windows security modification 2 TTPs 4 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- System policy modification 1 TTPs 6 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.DarkKomet.aagt.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.DarkKomet.aagt.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.DarkKomet.aagt.exe" +s +h2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.DarkKomet.aagt.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1File Deletion
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
msdcsc.exe
memory/1212-81-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-76-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-87-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-86-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-85-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-84-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-75-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-83-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-82-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-74-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-73-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-79-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-80-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-77-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1212-78-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1644-5-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/1736-69-0x00000000013D0000-0x00000000013D1000-memory.dmp
memory/3816-68-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/3816-64-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4764-2-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4764-0-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4764-71-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4764-1-0x00000000004C3000-0x00000000004C4000-memory.dmp
memory/4924-65-0x0000000000400000-0x00000000004C4000-memory.dmp