Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 00:16

General

  • Target

    65642f6048c56ff3ae6fb6cb91330e15_JaffaCakes118.exe

  • Size

    819KB

  • MD5

    65642f6048c56ff3ae6fb6cb91330e15

  • SHA1

    541cdd3507d5a80e04d2700e788649cf1df41a27

  • SHA256

    2d2abd10b60d6464e062eaa347bbeb48aa78a9cde4217a1f2c2cfc301953c9de

  • SHA512

    ec63b50e5ec96d9162b86299293aa894092b8141ae79846dda1439477d670aa3bb030b54bc2b526c249c548a79182b8faf5d2d8872ae82a02a5b8ffab34e3a0f

  • SSDEEP

    24576:8z////TfavT+0lJsnl/DwGts3nngrwF7ubcTRmgYaneKw9hSegs5cHCdEcRmUhsx:kkT+0onl/DwGts3nngrwF7ubcYgYan5v

Malware Config

Extracted

Family

darkcomet

Botnet

Spreaded

C2

simproxid.no-ip.org:1604

Mutex

DC_MUTEX-MXX0V30

Attributes
  • gencode

    jll1Ljobqc1P

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65642f6048c56ff3ae6fb6cb91330e15_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\65642f6048c56ff3ae6fb6cb91330e15_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3u0ymqul.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB54.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBB53.tmp"
        3⤵
          PID:2416
      • C:\Users\Admin\AppData\Local\Temp\NPaqpR.exe
        "C:\Users\Admin\AppData\Local\Temp\NPaqpR.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2892
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          3⤵
            PID:2956

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\NPaqpR.exe

        Filesize

        4KB

        MD5

        194da627fc66d769974bf6217d0f0d34

        SHA1

        084c303019facdfb275a6d0277677cf4c4a69fa8

        SHA256

        b5c7bd0bb9dd7ed651bf41af74a63c745f0c189aacf12b78d00ae0340944b9f7

        SHA512

        4309223412108cbcdf712124e6fd7913645195c2b49a33aac01ed1e14e8fc84db8a3e9549eaf0f7b3c34708942226c367748e5886874dbbd644eaf3e03b04dec

      • C:\Users\Admin\AppData\Local\Temp\RESBB54.tmp

        Filesize

        1KB

        MD5

        91b3570eb53f524b6a6d48f69e8068c3

        SHA1

        f0abdbc7ca4837ba9f400cc080b01a793b28585e

        SHA256

        c7c8bdeefb5056e66963adf86f8a569a694cb3116c3cab8c99012d1a4f2b61da

        SHA512

        8ea73e04c16a7ac27008c5e67bb34d3c46e3e666aa4a8c55fc2e52fd1cd6253e883e5c70614ff0207e6f28833eeacf34c354d77252e609874889b0bce04084a1

      • \??\c:\Users\Admin\AppData\Local\Temp\3u0ymqul.0.cs

        Filesize

        1KB

        MD5

        88cb62593ae10e37e02f7f43aee77246

        SHA1

        ed80fdfb7d3fbb035a544e712e92bc2438f6b089

        SHA256

        31a5a148395b88114101dedd9e5418b04b1b57d0964f0088b431aa4835631390

        SHA512

        811eef58966f3eb0723a6c6944f2ca9f504445260cdeb0e40faf3353924686634b8acdec0f35b4d9e1aa243ccae1cb419163630b822e1dba66e16f8f22bcc9f5

      • \??\c:\Users\Admin\AppData\Local\Temp\3u0ymqul.cmdline

        Filesize

        259B

        MD5

        9003215acbdcf7886bd99e71aa0dfba6

        SHA1

        078137a917bcb3d613a49229889f1865ba1766d3

        SHA256

        19e8d5ee6a4121428d0f28e355719942f6f86e68aaf57f41702af7947e40d6db

        SHA512

        9d5c918182de776a81a933e30fdb0e2db873b2275e7da6a9cfd7510d7ee8d4d95f77063c2034b039852481fe1eaa3fe851a73bebba6b7813dd030e667f6da70b

      • \??\c:\Users\Admin\AppData\Local\Temp\CSCBB53.tmp

        Filesize

        644B

        MD5

        14e95655e74fe8a8c7df3d505720ea45

        SHA1

        158511920ab075fd1f4eb51dbc47ccf2953358aa

        SHA256

        3cbee629e0898006d2e85803f1a78d29a26490ff88a7348313b07dd9c39ec398

        SHA512

        f01213dcae74c07ad0e07f9ff1f2eed11ef62feed100e78222c61a3495f4ec157fbc53123e05f9e938f24ca177e5e1dc49c9649636e333261d6efff843b696fa

      • \Users\Admin\AppData\Local\Temp\svchost.exe

        Filesize

        31KB

        MD5

        ed797d8dc2c92401985d162e42ffa450

        SHA1

        0f02fc517c7facc4baefde4fe9467fb6488ebabe

        SHA256

        b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

        SHA512

        e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

      • memory/2376-1-0x0000000074500000-0x0000000074AAB000-memory.dmp

        Filesize

        5.7MB

      • memory/2376-2-0x0000000074500000-0x0000000074AAB000-memory.dmp

        Filesize

        5.7MB

      • memory/2376-0-0x0000000074501000-0x0000000074502000-memory.dmp

        Filesize

        4KB

      • memory/2376-47-0x0000000074500000-0x0000000074AAB000-memory.dmp

        Filesize

        5.7MB

      • memory/2752-46-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-30-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-28-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-92-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-91-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-43-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2752-40-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-38-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-87-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-88-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-90-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-89-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-36-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-34-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-32-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2752-26-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

      • memory/2956-48-0x0000000000080000-0x0000000000081000-memory.dmp

        Filesize

        4KB

      • memory/2956-86-0x00000000001E0000-0x00000000001E1000-memory.dmp

        Filesize

        4KB

      • memory/2972-8-0x0000000074500000-0x0000000074AAB000-memory.dmp

        Filesize

        5.7MB

      • memory/2972-15-0x0000000074500000-0x0000000074AAB000-memory.dmp

        Filesize

        5.7MB