Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 21:02

General

  • Target

    1370a3aa17c0e03bf6c1a0dddcf74c50_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    1370a3aa17c0e03bf6c1a0dddcf74c50

  • SHA1

    280c31716364a98c5cad224a9087ede8d6890920

  • SHA256

    1f96a1ece5b29ad2d08a0e9e7a306296e73545a09db0de6337843bbab7084f8e

  • SHA512

    1e31e290eb84cb38405459467ae7dd10311250ab4cc2488f801382e56c3860ed46b904c8e5ae57ef78e84f53c9b6a6c2da7d8ed489b7f1edd15cdf0b73bf7cf0

  • SSDEEP

    24576:iYgQb817PYX/BC5iqycTWOY1Ri7Y8CD71GG+psFk:iJQb81Tw/BCOcqka1

Malware Config

Extracted

Family

darkcomet

Botnet

Testing123

C2

administrator.redirectme.net:1604

Mutex

DC_MUTEX-U8JMMMH

Attributes
  • gencode

    CnzPKbNDUdiU

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1370a3aa17c0e03bf6c1a0dddcf74c50_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1370a3aa17c0e03bf6c1a0dddcf74c50_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\System32\rundll32.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2732-0-0x00000000744E1000-0x00000000744E2000-memory.dmp

    Filesize

    4KB

  • memory/2732-1-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2732-2-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2732-16-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2896-6-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-5-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-8-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-7-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-11-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-13-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-15-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2896-17-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-19-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-18-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-20-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-21-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2896-22-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB