darkcomet | 165ff1578ec1e7cec6fac6fbbb3522012beb5cb616c2bb8896ae71ff6aa2b3d2

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.MSIL.Zapchast.ct.exe
Size 4.1MB
Sample261016-d97xdagy8p
SHA256 165ff1578ec1e7cec6fac6fbbb3522012beb5cb616c2bb8896ae71ff6aa2b3d2
MD5 f890bf8f1557cef930d407471b43cf8c
SHA1 3ed749f284dd603eb2541b4969f59f4392cf84d0
SHA512 ebad83fc861cc66c1c88b556bf5360e53d500b97690c35aba97514f1a842ea9a900a900b62ec4634d5ddd6195f95b889a22f582ca5e91969d20f77766c1848f4
SSDEEP 49152:2/gYAhExqWzqobqmOT/WCbk/AWrW6gIfZAnBtk8rk7Re/CJym9B5HXZJNybK21MB:kAhEkWz7
TLSH
T19F1633617F49ADBECA3CC33A60FF6A081A611E51D149D3AB73D831D714AA3829453C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

2012 defense_evasion discovery darkcomet persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

2012

127.0.0.1:1604
newsi123.no-ip.org:1604

Mutex

DC_MUTEX-BZVR673

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
QcfEX6iwy5nE
install
true
offline_keylogger
true
password
azerazer
persistence
true
reg_key
MicroUpdate

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe	svchost.exe

Executes dropped EXE 8 IoCs

pid	Process
3720	2012 Crypter Public.exe
1268	WinUpdate.exe
3332	java.exe
908	stub1.exe
3744	stub2.exe
1308	builder.exe
2880	svchost.exe
5368	stub1.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinUpdate.exe"	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Sheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	java.exe

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2964-8-0x0000000004F70000-0x0000000004F7C000-memory.dmp	SmartAssembly
behavioral2/memory/2964-9-0x0000000004F80000-0x0000000004F8A000-memory.dmp	SmartAssembly
behavioral2/files/0x000d00000001c59f-54.dat	SmartAssembly

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 1268 set thread context of 3016	1268	WinUpdate.exe	95
PID 908 set thread context of 5368	908	stub1.exe	102

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5368-243-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2012 Crypter Public.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	java.exe
Token: SeRestorePrivilege	972	dw20.exe
Token: SeBackupPrivilege	972	dw20.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3332	java.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
908	stub1.exe
3744	stub2.exe
3332	java.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 2160	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	89
PID 2964 wrote to memory of 3720	2964	jaffacakes118_Trojan.MSIL.Zapchast.ct.exe	90
PID 3720 wrote to memory of 3332	3720	2012 Crypter Public.exe	93
PID 3720 wrote to memory of 908	3720	2012 Crypter Public.exe	94
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 1268 wrote to memory of 3016	1268	WinUpdate.exe	95
PID 3720 wrote to memory of 3744	3720	2012 Crypter Public.exe	96
PID 3720 wrote to memory of 1308	3720	2012 Crypter Public.exe	97
PID 1308 wrote to memory of 972	1308	builder.exe	98
PID 908 wrote to memory of 5368	908	stub1.exe	102
PID 908 wrote to memory of 5368	908	stub1.exe	102
PID 908 wrote to memory of 5368	908	stub1.exe	102
PID 908 wrote to memory of 5368	908	stub1.exe	102

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.MSIL.Zapchast.ct.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.MSIL.Zapchast.ct.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:2160
- C:\Users\Admin\AppData\Local\Temp\2012 Crypter Public.exe
  "C:\Users\Admin\AppData\Local\Temp\2012 Crypter Public.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Users\Admin\AppData\Roaming\java.exe
    "C:\Users\Admin\AppData\Roaming\java.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3332
- - C:\Users\Admin\AppData\Roaming\stub1.exe
    "C:\Users\Admin\AppData\Roaming\stub1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Users\Admin\AppData\Roaming\stub1.exe
      "C:\Users\Admin\AppData\Roaming\stub1.exe"
      4⤵
      Executes dropped EXE
      PID:5368
- - C:\Users\Admin\AppData\Roaming\stub2.exe
    "C:\Users\Admin\AppData\Roaming\stub2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3744
- - C:\Users\Admin\AppData\Roaming\builder.exe
    "C:\Users\Admin\AppData\Roaming\builder.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 864
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:972

C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:3016

C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2012 Crypter Public.exe

Path C:\Users\Admin\AppData\Local\Temp\2012 Crypter Public.exe
Size 794KB
SHA256 254ca1c1d37423ebfe66f6aaed9e9993845e1ea6f656f83ce49dbbcaa9a68d4a
MD5 df5bc3dcb94e1356b78cf095106f0452
SHA1 3a1e67528de801e5e96bb0c0ca558441efcf011e
SHA512 ab3a6b009dba94f4b2652f92cba9f7f2f948836cbf903aef387b72681fe295cf5c3098ab02d2498a59e8bc65ebe089a07a777261d249090ef32c283b13eaccbf
SSDEEP 12288:jtNeHzIlHcKVUkLuTzNkVWK5hrx6MpB/kOOJvD0M0RkZ5qsUiDMCck9+Jf6Be:BNQUrrLuTzNMrFB/tOJvDH0Chek9+Jfv
TLSH
T13E052327EFB585E1CFA228FC5E04443A7C3BE8E25D319AA7DD51944E2C321A78B4187D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
Size 4.1MB
SHA256 165ff1578ec1e7cec6fac6fbbb3522012beb5cb616c2bb8896ae71ff6aa2b3d2
MD5 f890bf8f1557cef930d407471b43cf8c
SHA1 3ed749f284dd603eb2541b4969f59f4392cf84d0
SHA512 ebad83fc861cc66c1c88b556bf5360e53d500b97690c35aba97514f1a842ea9a900a900b62ec4634d5ddd6195f95b889a22f582ca5e91969d20f77766c1848f4
SSDEEP 49152:2/gYAhExqWzqobqmOT/WCbk/AWrW6gIfZAnBtk8rk7Re/CJym9B5HXZJNybK21MB:kAhEkWz7
TLSH
T19F1633617F49ADBECA3CC33A60FF6A081A611E51D149D3AB73D831D714AA3829453C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

builder.exe

Path C:\Users\Admin\AppData\Roaming\builder.exe
Size 481KB
SHA256 0365cbd6d0567aadffebbd32df6be54f898fcbdefec1de49288227fc64016687
MD5 c37258b9d93dad811cd21529d68f38b4
SHA1 41e579986cb8187fd59092ab7110e58b1dbcdc94
SHA512 efc3b6c76d5b60c7e456bdb58d44e1e2ab8e4665019d5f094a7b0f62ed77e063f82ae61836551c54853efc2992b1a2cb7895315155488915aa47d4a81e4e472b
SSDEEP 6144:Ha+Si7xBBgXuAw9vaiyKtqZMXnPO3jjLTPHYgY93WipyRWr+ITcwaC:NgZw9Sr3jjfHYF93W8yunaC
TLSH
T1F7A47B3536446FB3D6BC22782006D1C18FF64251A227EF9D6F6660DA1D80B9F8B3F658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\java.exe
Size 116KB
SHA256 2aa0379682bb98e5b833e2749e9d9bca729014d7deef6e49fa58bf60adc3e077
MD5 5b5ae33ed706168262ff5897a8ddbe95
SHA1 7e06310adde90478158afb52bab8ae1eadc7e5ac
SHA512 1a0fce030fb552fb60e6cb4d923d34ec981d1a7662cd4acf07498716e821bc0ed1d49eb118a36e975c104d20776578114ffc02e682e5b086c8c7b447f92ed209
SSDEEP 3072:onAvpWcGbFWLD9le1VNukjX5nSViWzI2d692:7CAelPdw0289
TLSH
T16AC3BE18AE8E8523DB8AC7FDE8D11A9107B98D337A63FB9FCD4071511872399444A3B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stub1.exe

Path C:\Users\Admin\AppData\Roaming\stub1.exe
Size 276KB
SHA256 6a58a99a57661f16d3b7788251996139467dbb7852e1b07024e0c8177d067f7c
MD5 721adc4df61a73f3b791786d27129555
SHA1 2d80c7fd990fc526ebb8dc4dd498f8103041785b
SHA512 1c48584a708990f109ef10986cfe640dd82b94a1985f1ee102bc82a6421a756185fc0099e4413998629a1d8225268d2d7bbe00170c079a8e091c7ce9171c574f
SSDEEP 3072:NPVWyvfTe0xMW9jJd+j4Ro4gVxGsCyVIDmxI06vggTSDgRCT2auGmOe5a2vMIItp:NPXvfHzvX9y5CyHYggvDL/5l
TLSH
T1B8545B3D6EA54437E2B5CB74DAE45A9BF169B87379511D0A81CB43490A33B83B4E032F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stub2.exe

Path C:\Users\Admin\AppData\Roaming\stub2.exe
Size 220KB
SHA256 699712e49eeb81b99b8f40e81b52d2b13c59432c1d41214c0ba72cafbb6662f6
MD5 2f078304c102772f6161919af7d37052
SHA1 0a61d6379348655acd6bad8d88a22fc707d421e3
SHA512 57940fe5a79a93a567f02a22060d97a5c49d51d528ed0815949713cbff2b55363874f3ab759e6f8399a6880a9f382ef69e97f26f993629f34e9ea2eea5951b29
SSDEEP 3072:tuZ0NGTA8dM9S3gN89VOwXR/RBqUkRAsq9m8dUUZoxRlzY9D:tiS9it9VOsv2GsqtZMT8
TLSH
T17D243A3D1DAA4537F3BADB74C8E06A93F062BA637441AD1C58D743491C77A83B8C162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-10-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2964-8-0x0000000004F70000-0x0000000004F7C000-memory.dmp

Download

memory/2964-0-0x00000000743B2000-0x00000000743B3000-memory.dmp

Download

memory/2964-9-0x0000000004F80000-0x0000000004F8A000-memory.dmp

Download

memory/2964-7-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/2964-6-0x0000000004D80000-0x0000000004DD6000-memory.dmp

Download

memory/2964-24-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/2964-5-0x0000000004CD0000-0x0000000004CDA000-memory.dmp

Download

memory/2964-4-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Download

memory/2964-3-0x0000000005340000-0x00000000058FA000-memory.dmp

Download

memory/2964-2-0x0000000004C30000-0x0000000004CCC000-memory.dmp

Download

memory/2964-1-0x00000000000D0000-0x000000000011A000-memory.dmp

Download

memory/5368-243-0x0000000000400000-0x0000000000473000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads