Analysis
-
max time kernel
141s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08-07-2024 09:03
General
-
Target
2bc014e0b436c8598595a4929fc389d9_JaffaCakes118.exe
-
Size
758KB
-
MD5
2bc014e0b436c8598595a4929fc389d9
-
SHA1
4b1164b3d9818b4b46cc637dc76a483fcb4fe3de
-
SHA256
c853f2160b801722f218c4a1cb9c161d2f05a2f6d24a867bbfb663cb70bfdebd
-
SHA512
398d2c043962fa51800ba07afec3ca6bda481c5477002ea510d45e45dcd9a42ee3274356c6b92bd364af22d845616eb33e8bbee120f2e78ba2ce7bf5cc7fd9b3
-
SSDEEP
12288:mXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U+:onAw2WWeFcfbP9VPSPMTSPL/rWvzq4Ju
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
127.0.0.1:1604
Mutex
DC_MUTEX-2L8UMLQ
Attributes
-
gencode
Zt2Ki25YtqN3
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc014e0b436c8598595a4929fc389d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2bc014e0b436c8598595a4929fc389d9_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
820KB