Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
02-07-2024 07:54
General
-
Target
1e8a3b5c9f303c24d611e119151378f4_JaffaCakes118.exe
-
Size
252KB
-
MD5
1e8a3b5c9f303c24d611e119151378f4
-
SHA1
f4bd5b930afd9ff7104cb93acde4733c0e92b4e6
-
SHA256
8b24f5697f0e5e2922b85abc6e70e8efbc53ced68d6ad99fa0fbf5fc544dea9d
-
SHA512
e30f14d29407b659e022f6c44371ab12f855abd375ea90c6f10bb2e3a47664be21cacc13cf9443513994795d2a5e4675ab154a9c7394d5d0d6a11533a974b42b
-
SSDEEP
6144:aD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ5:al8E4w5huat7UovONzbXw
Malware Config
Extracted
darkcomet
Guest16
niggerdicksinmyass.no-ip.org:666
DC_MUTEX-UA9KK5X
-
gencode
siiDlkN8r6sY
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e8a3b5c9f303c24d611e119151378f4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e8a3b5c9f303c24d611e119151378f4_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4264-0-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-1-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/4264-2-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-3-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-4-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-5-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-6-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-7-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-8-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-9-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-10-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-11-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-12-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-13-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-14-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4264-15-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB