Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
22/07/2024, 16:46
General
- Target 63f9723347a7bea08e0fb6bd01f3ad88_JaffaCakes118.exe
- Size 636KB
- Sample240722-vacqmaxbnh
- SHA256 66bde5cc3371d495bdad3f685cf6dbbd911b2a8af5a507d00a126e2a2d85428d
Malware Config
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63f9723347a7bea08e0fb6bd01f3ad88_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63f9723347a7bea08e0fb6bd01f3ad88_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\plugtemp\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
memory/2020-21-0x0000000074AE0000-0x00000000750E8000-memory.dmp
memory/2020-29-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-35-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-8-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-13-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-14-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-16-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-34-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-20-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-19-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-18-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-33-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-23-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-32-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-28-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-25-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-26-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-27-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-24-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-22-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-30-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2020-31-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/4088-2-0x0000000074B30000-0x00000000750E1000-memory.dmp
memory/4088-0-0x0000000074B32000-0x0000000074B33000-memory.dmp
memory/4088-17-0x0000000074B30000-0x00000000750E1000-memory.dmp
memory/4088-1-0x0000000074B30000-0x00000000750E1000-memory.dmp