Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
28-04-2024 18:08
General
-
Target
05c722cd6347a2c8f0970b6af97f9436_JaffaCakes118.exe
-
Size
689KB
-
MD5
05c722cd6347a2c8f0970b6af97f9436
-
SHA1
6c3219997c69b74ac1920eaf5b6a86abd37b45ac
-
SHA256
96f55c7552aa488f7c42ef96a312724084555b9851279fe679ea0ece894dbea9
-
SHA512
4135399b45ffff13480992020a0935431e3fff5a14e0a121170952e0b7104c297389f573f74b44931c4f1282342d2c86b8dceb7ddc5b72d34acfd48fbdd5c811
-
SSDEEP
12288:B9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hQ1:7Z1xuVVjfFoynPaVBUR8f+kN10EBC
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
127.0.0.1:1604
Mutex
DC_MUTEX-TXST7PF
Attributes
-
gencode
jB26FFbJUbDf
-
install
false
-
offline_keylogger
true
-
password
111
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05c722cd6347a2c8f0970b6af97f9436_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05c722cd6347a2c8f0970b6af97f9436_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB