Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
15/07/2024, 04:24
General
- Target 4835b5cf035e7bcffe4a513abfa75107_JaffaCakes118.exe
- Size 1.5MB
- Sample240715-e1hfssxgkl
- SHA256 8b096259025bfc64f9bd25804af7792eb9b79137c30d62306590990aa72817ef
Malware Config
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4835b5cf035e7bcffe4a513abfa75107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4835b5cf035e7bcffe4a513abfa75107_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KOBACCRYPTER.EXE"C:\Users\Admin\AppData\Local\Temp\KOBACCRYPTER.EXE"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
KOBACCRYPTER.EXE
memory/924-35-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-49-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-4-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-3-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-6-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-43-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-11-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-12-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-13-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-42-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-33-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-53-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-52-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-51-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-50-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-44-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-45-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-48-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-46-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-47-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-38-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-36-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-37-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-34-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/924-39-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/1856-2-0x0000000074890000-0x0000000074E41000-memory.dmp
memory/1856-0-0x0000000074892000-0x0000000074893000-memory.dmp
memory/1856-1-0x0000000074890000-0x0000000074E41000-memory.dmp
memory/1856-10-0x0000000074890000-0x0000000074E41000-memory.dmp
memory/2864-25-0x00000000738AE000-0x00000000738AF000-memory.dmp
memory/2864-41-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/2864-40-0x00000000738AE000-0x00000000738AF000-memory.dmp
memory/2864-31-0x0000000004D80000-0x0000000004DD6000-memory.dmp
memory/2864-32-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/2864-30-0x0000000004C40000-0x0000000004C4A000-memory.dmp
memory/2864-29-0x0000000004C80000-0x0000000004D12000-memory.dmp
memory/2864-28-0x0000000005190000-0x0000000005734000-memory.dmp
memory/2864-27-0x0000000004B10000-0x0000000004BAC000-memory.dmp
memory/2864-26-0x0000000000180000-0x00000000001A4000-memory.dmp