Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
29/08/2024, 05:57
General
- Target c8540f3ce356e776961725b77030d61b_JaffaCakes118.exe
- Size 1.3MB
- Sample240829-gnyncswhpd
- SHA256 592fc03ddc9e8ead3924d419fe085336a7c46bf98fa7236407abd0a0f614c69d
Malware Config
Extracted
-
darkcomet
-
Guest16
-
ilj98348.no-ip.biz:1608
-
DC_MUTEX-RY18R40
-
gencode
6nKFE9T9fdUi
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
-
darkcomet
-
BOT
-
kl0w.no-ip.org:1604
-
mozillaproxy.zapto.org:1604
-
DC_MUTEX-A5603PV
-
gencode
8UDgycR8v6YU
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
-
latentbot
-
mozillaproxy.zapto.org
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
- Executes dropped EXE 1 IoCs
- UPX packed file 44 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8540f3ce356e776961725b77030d61b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c8540f3ce356e776961725b77030d61b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c8540f3ce356e776961725b77030d61b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\c8540f3ce356e776961725b77030d61b_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\file2.exeC:\Users\Admin\AppData\Local\Temp\file2.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut8453.tmp
file2.exe
memory/1040-29-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-40-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-13-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-12-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-14-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-16-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-15-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-10-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-60-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-8-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-44-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-30-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-11-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-33-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-31-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-56-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-54-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-36-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-52-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-38-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-50-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-58-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-48-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-42-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1040-46-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-28-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-45-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-43-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-47-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-41-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-49-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-39-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-51-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-37-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-53-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-34-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-55-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-35-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-57-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-32-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-59-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-26-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4664-61-0x0000000000400000-0x00000000004B7000-memory.dmp