Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
19/07/2024, 00:12
General
- Target 59ae51105cb24b652f5ff2a4c3121104_JaffaCakes118.exe
- Size 973KB
- Sample240719-ahn4eawgpd
- SHA256 482ca37b403c105b22c4c4bdc567b0e835bc4d9cae433ddc04ae825ec67a97c1
Malware Config
Extracted
-
darkcomet
-
Darkdodo
-
samstar.no-ip.info:1604
-
DC_MUTEX-0NZCQJL
-
gencode
FNM82ltnAYMt
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59ae51105cb24b652f5ff2a4c3121104_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\59ae51105cb24b652f5ff2a4c3121104_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\59ae51105cb24b652f5ff2a4c3121104_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2224-2-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-3-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-4-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-5-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-6-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-7-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-8-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-9-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-10-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-13-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-14-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-15-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-16-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-18-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-19-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-20-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-21-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2224-23-0x0000000000400000-0x00000000004B0000-memory.dmp