Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
21/08/2024, 12:34
General
- Target b378bd3fd8915adfbc82ff1be978b121_JaffaCakes118.exe
- Size 878KB
- Sample240821-pr49baydnc
- SHA256 c5b75c314ef6f47f909e6575b202dc67820709825d684acf8255267991a1a97d
Malware Config
Extracted
-
darkcomet
-
Guest16
-
trelofidaki.no-ip.org:6666
-
DC_MUTEX-VLN5T02
-
gencode
EavQUc2KKBrY
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b378bd3fd8915adfbc82ff1be978b121_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b378bd3fd8915adfbc82ff1be978b121_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1932-28-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-27-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-11-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-10-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-12-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-13-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-15-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-14-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-18-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-17-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-16-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-24-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-23-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-52-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-51-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-56-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-21-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-25-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-67-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-26-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-29-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-1-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-19-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-49-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-57-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/1932-50-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-47-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-44-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-40-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-39-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-36-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-35-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-22-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-32-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-9-0x00000000757F0000-0x00000000757F1000-memory.dmp
memory/1932-34-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-30-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-48-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-46-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-53-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-45-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-43-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-42-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-41-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-38-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-37-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-20-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-33-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/1932-31-0x0000000000A50000-0x0000000000B16000-memory.dmp
memory/2428-68-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-61-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-62-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/2428-63-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/2428-65-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-66-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-72-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-71-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-69-0x00000000757D0000-0x00000000758C0000-memory.dmp
memory/2428-73-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-59-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-70-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-58-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-74-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-75-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-76-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-77-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-78-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-79-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-80-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-81-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2428-82-0x0000000000400000-0x00000000004B2000-memory.dmp