Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
23/07/2024, 12:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
- Target 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe
- Size 521KB
- Sample240723-pd7saasbmg
- SHA256 ea8e4fda194c9b93c80f62c549b342e06c7079d25a73180f0699775e31c7371b
- MD5 678c941e97351d00c4ad788f517a3005
- SHA1 e7f445ad79f4aa13c37e8d7ee3a0ab10c805ac03
- SHA512 97f1cbfb6d92e3b4acb6d6396af4efd4d6dca78ec24dfb5e9eebe73647500477cb6fe37ef115d5e404a64c341602a33073b569710bf2b466781b35d628bd35be
- SSDEEP 12288:wAun8MBDxCWo9kvrVHeeC3T2+Asgoi7YxX97ni7c:wAun8MBgWukNC3hhiWNnt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
ab11.no-ip.biz:1604
Mutex
-
DC_MUTEX-ENK4SB4
Attributes
-
gencode
dqVWNGpFujjS
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
resource yara_rule behavioral2/memory/4688-3-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/4688-4-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/4688-7-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/4688-8-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/4688-9-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/4688-10-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/4688-14-0x0000000000400000-0x00000000004BA000-memory.dmp upx - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3884 set thread context of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 4688 set thread context of 1584 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 89 PID 1584 set thread context of 212 1584 iexplore.exe 90 - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeSecurityPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeSystemtimePrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeBackupPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeRestorePrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeShutdownPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeDebugPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeUndockPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeManageVolumePrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeImpersonatePrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: 33 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: 34 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: 35 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: 36 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 212 iexplore.exe Token: SeSecurityPrivilege 212 iexplore.exe Token: SeTakeOwnershipPrivilege 212 iexplore.exe Token: SeLoadDriverPrivilege 212 iexplore.exe Token: SeSystemProfilePrivilege 212 iexplore.exe Token: SeSystemtimePrivilege 212 iexplore.exe Token: SeProfSingleProcessPrivilege 212 iexplore.exe Token: SeIncBasePriorityPrivilege 212 iexplore.exe Token: SeCreatePagefilePrivilege 212 iexplore.exe Token: SeBackupPrivilege 212 iexplore.exe Token: SeRestorePrivilege 212 iexplore.exe Token: SeShutdownPrivilege 212 iexplore.exe Token: SeDebugPrivilege 212 iexplore.exe Token: SeSystemEnvironmentPrivilege 212 iexplore.exe Token: SeChangeNotifyPrivilege 212 iexplore.exe Token: SeRemoteShutdownPrivilege 212 iexplore.exe Token: SeUndockPrivilege 212 iexplore.exe Token: SeManageVolumePrivilege 212 iexplore.exe Token: SeImpersonatePrivilege 212 iexplore.exe Token: SeCreateGlobalPrivilege 212 iexplore.exe Token: 33 212 iexplore.exe Token: 34 212 iexplore.exe Token: 35 212 iexplore.exe Token: 36 212 iexplore.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 1584 iexplore.exe 212 iexplore.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 3884 wrote to memory of 4688 3884 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 87 PID 4688 wrote to memory of 1584 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 89 PID 4688 wrote to memory of 1584 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 89 PID 4688 wrote to memory of 1584 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 89 PID 4688 wrote to memory of 1584 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 89 PID 4688 wrote to memory of 1584 4688 678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe 89 PID 1584 wrote to memory of 212 1584 iexplore.exe 90 PID 1584 wrote to memory of 212 1584 iexplore.exe 90 PID 1584 wrote to memory of 212 1584 iexplore.exe 90 PID 1584 wrote to memory of 212 1584 iexplore.exe 90 PID 1584 wrote to memory of 212 1584 iexplore.exe 90 PID 1584 wrote to memory of 212 1584 iexplore.exe 90 PID 1584 wrote to memory of 212 1584 iexplore.exe 90 PID 1584 wrote to memory of 212 1584 iexplore.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\678c941e97351d00c4ad788f517a3005_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\678c941e97351d00c4ad788f517a3005_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:212
-
-
-