Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
25-06-2024 08:58
General
-
Target
0d760fc34014169f581fdf93cb8b8bb0_JaffaCakes118.exe
-
Size
252KB
-
MD5
0d760fc34014169f581fdf93cb8b8bb0
-
SHA1
3f3d39c39bbdce426d884ad4de5cd29ae6711f85
-
SHA256
47e06f2771f35ede3bfdff285c3d76a3ca95b4483f9389571ccc60efa7eb9f83
-
SHA512
f3d42c9e2e194d175e7ce5715891c98d93da79a87cdcf16424712f5637bb507db0a3221791d2352b9f47d5c65bb59520d09121c853ec5d62179bab6f08dfb17b
-
SSDEEP
6144:CMI/jlS4kCwHL76nz9Q3uR5LTYYBIsHqvk:CMQlS9Cwr79uLLTvBIYd
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
192.168.0.103:1602
Mutex
DC_MUTEX-576K9F2
Attributes
-
gencode
hG6U5YN7E4QL
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d760fc34014169f581fdf93cb8b8bb0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d760fc34014169f581fdf93cb8b8bb0_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2056-0-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/2056-1-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2056-2-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/2056-4-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB