Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 20:26

General

  • Target

    759659ac9816a28383faeda799b1e6de_JaffaCakes118.exe

  • Size

    681KB

  • MD5

    759659ac9816a28383faeda799b1e6de

  • SHA1

    465fd31c664f9766c87bfadf1c147259d8579c37

  • SHA256

    11ab6ac3b489b6662c7b638e3e94db436bcac428ce8260b3428611ed600afdc5

  • SHA512

    617703e33122f6d81910a21829f44dc0116729fdea39fa11085bef95e22191b5f43e4eb2fa88eca1085042e5562ea385479216005a5ff359fc66b06ddacad590

  • SSDEEP

    12288:S+SRRw04j29U9RpijpJDKQ4LP/6NRJ03k4IgKHxqr4M2GbIZv2/vxpgNM11sab2F:i94/Rp20/6ghPKHM2Z23xeW1ai2lgxo

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

hakimzaio1.no-ip.biz:1604

Mutex

DC_MUTEX-209H53N

Attributes
  • gencode

    PkcUmjfCvV9f

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\759659ac9816a28383faeda799b1e6de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\759659ac9816a28383faeda799b1e6de_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3032
    • \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\jjjj\1.0.0.0\2012.04.08T19.13\Virtual\STUBEXE\8.0.1135\@DESKTOP@\hoaaa.exe
      "C:\Users\Admin\Desktop\hoaaa.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2360
      • \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\jjjj\1.0.0.0\2012.04.08T19.13\Native\STUBEXE\8.0.1135\@PROGRAMFILES@\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2544
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
          PID:2612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Xenocode\Sandbox\jjjj\1.0.0.0\2012.04.08T19.13\Native\STUBEXE\8.0.1135\@PROGRAMFILES@\Internet Explorer\iexplore.exe

      Filesize

      17KB

      MD5

      83e15607a85eb6252d05c6aedfa028da

      SHA1

      b018f91204486641a564e52a977fce59de263c07

      SHA256

      a4b68b0650631bb9c1d8ad1b332af503cec3d3fa55fe25ffea8a1f43af9ff3ff

      SHA512

      61d327fae6e8b339649adb3c8beb2d43b9de24df7e0a808f85df2ac51374753042e37f09b4d5b523261eeeaf5b5bbce011f76ec7c312d0f5aea8b2cb667461f3

    • \Users\Admin\AppData\Local\Xenocode\Sandbox\jjjj\1.0.0.0\2012.04.08T19.13\Virtual\MODIFIED\@DESKTOP@\hoaaa.exe

      Filesize

      649KB

      MD5

      277d82cb96c5627aaf8cb662ee2be7fa

      SHA1

      c47a2bf628f40be300d01651af267bcfbdf46cb5

      SHA256

      5be45ae092102a073ad4fe5e228f393c8270b081837733511bfa5c364f115a9e

      SHA512

      6b3339273eabaaf47f887d3e5334daf61f58917b141a5c363292327378f81b0635a88bee2ab802803a12e50fd1f912822aabe241448f9e13af3885e4d974640f

    • \Users\Admin\AppData\Local\Xenocode\Sandbox\jjjj\1.0.0.0\2012.04.08T19.13\Virtual\STUBEXE\8.0.1135\@DESKTOP@\hoaaa.exe

      Filesize

      17KB

      MD5

      4422a8a32fa7895c1eb3cdc97a705cc5

      SHA1

      d5dd26bee0f4a47ca784a94f82f553f6bf2321b2

      SHA256

      63b6201b60d2e627cb1b739d882a613693cdc2588decdac40c520e86a80014f3

      SHA512

      4e060cdc6b8182f523d6a47e91afffbb168c389d1e6d5c992333ab3e4e8bd1d533a2a866175438e0d1589fa1270ce1081d1bb8fdcf8a4de45783673be968d867

    • memory/2360-29-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-70-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-72-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-71-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-27-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-69-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-68-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-67-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-12-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-24-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-34-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-35-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-33-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-26-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-36-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-31-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-30-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-39-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-47-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-46-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-48-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-45-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-44-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-43-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-42-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-41-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-40-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-38-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-37-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-66-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-28-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-65-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-32-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-25-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-23-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-22-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-21-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-20-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-18-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-17-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-16-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-14-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-13-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-19-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-64-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-53-0x0000000000590000-0x0000000000602000-memory.dmp

      Filesize

      456KB

    • memory/2360-63-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-62-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-57-0x0000000000590000-0x0000000000602000-memory.dmp

      Filesize

      456KB

    • memory/2360-59-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-60-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2360-61-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2544-56-0x00000000003F0000-0x000000000045D000-memory.dmp

      Filesize

      436KB

    • memory/3032-7-0x0000000077AE0000-0x0000000077AE1000-memory.dmp

      Filesize

      4KB

    • memory/3032-52-0x0000000000360000-0x00000000003D2000-memory.dmp

      Filesize

      456KB

    • memory/3032-4-0x0000000010000000-0x0000000010037000-memory.dmp

      Filesize

      220KB

    • memory/3032-8-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/3032-6-0x0000000000360000-0x00000000003D2000-memory.dmp

      Filesize

      456KB

    • memory/3032-5-0x0000000000360000-0x00000000003D2000-memory.dmp

      Filesize

      456KB

    • memory/3032-0-0x0000000010000000-0x0000000010037000-memory.dmp

      Filesize

      220KB

    • memory/3032-1-0x0000000010000000-0x0000000010037000-memory.dmp

      Filesize

      220KB

    • memory/3032-2-0x0000000010000000-0x0000000010037000-memory.dmp

      Filesize

      220KB

    • memory/3032-3-0x0000000010000000-0x0000000010037000-memory.dmp

      Filesize

      220KB