Overview

overview

10

Static

static

3

f6deaf165d...18.exe

windows7-x64

10

f6deaf165d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6deaf165da7a337c68048a046178c57_JaffaCakes118

  • Size

    318KB

  • Sample

    240418-aepkrsba22

  • MD5

    f6deaf165da7a337c68048a046178c57

  • SHA1

    ff6ce2d1eb1d81a392e0b6acf02017fbbf526181

  • SHA256

    d19c4864f78997a15056dd3dd3e53e144c412d1add11866ed2b36c6e933797a5

  • SHA512

    ba8f18fc2806e3325e09dd7aef269da6eacf6ce6a884b87b4e354b311106a0f24bbc147ba987087bdfa861d395b9412c5464efbd7a570d51a4d0d75a83dc5562

  • SSDEEP

    6144:gTu5OUFQPwNcv0kPmAGsyRILcAHRsNW+oKE0QJDBx0KEVaLOrd8ZH22aY:iuzmOCzGyiNW+oz06Bx0fByH2BY

Score
10/10
darkcomethawkeyekeyloggerpersistenceratspywarestealertrojanupx

Malware Config

Targets

    • Target

      f6deaf165da7a337c68048a046178c57_JaffaCakes118

    • Size

      318KB

    • MD5

      f6deaf165da7a337c68048a046178c57

    • SHA1

      ff6ce2d1eb1d81a392e0b6acf02017fbbf526181

    • SHA256

      d19c4864f78997a15056dd3dd3e53e144c412d1add11866ed2b36c6e933797a5

    • SHA512

      ba8f18fc2806e3325e09dd7aef269da6eacf6ce6a884b87b4e354b311106a0f24bbc147ba987087bdfa861d395b9412c5464efbd7a570d51a4d0d75a83dc5562

    • SSDEEP

      6144:gTu5OUFQPwNcv0kPmAGsyRILcAHRsNW+oKE0QJDBx0KEVaLOrd8ZH22aY:iuzmOCzGyiNW+oz06Bx0fByH2BY

    Score
    10/10
    darkcomethawkeyekeyloggerpersistenceratspywarestealertrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks