Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
25/08/2024, 17:05
General
-
Target
c130bbf77fa9a02551162a7f4c831cd6_JaffaCakes118.exe
-
Size
237KB
-
MD5
c130bbf77fa9a02551162a7f4c831cd6
-
SHA1
b612b77b29bddbbe6ccf030e8b98b179e99bad90
-
SHA256
4d606a732ea9794b1859a7a605a51b2af1f7c833c053d050624964f177526db6
-
SHA512
8fb1247eca63a76bceed7588b938a2b79f74fa9b0c08deb8ff9816e8bd16eb73ee08ef429402d6d6193e2fdcc26f29f6e45efd9fc6826f0d0d46b8d8394af91a
-
SSDEEP
6144:5y22ByAreNz+rtZOLqJ5Z7Ro94BDLbP2rr4hm:+y1NzKZeqpR0SnbP2PG
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-MMQTTUR
-
gencode
LoA2TcppGl4t
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c130bbf77fa9a02551162a7f4c831cd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c130bbf77fa9a02551162a7f4c831cd6_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
732KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB