Analysis
- max time kernel
148s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
20/07/2024, 03:42
General
- Target 5ee675020adbc7687a764fb458f3d550_JaffaCakes118.exe
- Size 922KB
- Sample240720-d9f4navcnr
- SHA256 66d63c30197d733585f426613415fc20d0b0609bbc50ad9f494f00f64db83167
Malware Config
Extracted
-
darkcomet
-
Guest16
-
127.0.0.1:1604
-
DC_MUTEX-2P7NG9W
-
gencode
4PigqPDhmrfp
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ee675020adbc7687a764fb458f3d550_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5ee675020adbc7687a764fb458f3d550_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exeC:\Users\Admin\AppData\Local\Temp\\plugtemp\Service.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Service.exe
memory/1328-13-0x00000000022E0000-0x00000000022E1000-memory.dmp
memory/1328-17-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-6-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-30-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-9-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-10-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-25-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-14-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-12-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-22-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1328-18-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1732-0-0x00000000752E2000-0x00000000752E3000-memory.dmp
memory/1732-16-0x00000000752E0000-0x0000000075891000-memory.dmp
memory/1732-2-0x00000000752E0000-0x0000000075891000-memory.dmp
memory/1732-1-0x00000000752E0000-0x0000000075891000-memory.dmp