Overview

overview

10

Static

static

3

4ab17dc92c...18.exe

windows7-x64

10

4ab17dc92c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2024 21:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ab17dc92cf4aa8230d6fac5931d9564_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    4ab17dc92cf4aa8230d6fac5931d9564

  • SHA1

    1a2c1029f0baffe08e92373292739d616607fea0

  • SHA256

    c2a7156cc2c645df95d6af8f2ee7ace159f3772149213f896bc82d9bc8c7a5d2

  • SHA512

    56e43b5f9ce4744ea8a4c4568e6234765b6737324122d1fd430db70c2bafd1a81f20d5db5cacb9b631eb4e3b2cc08c031c8b267f954b098791da48e91b4c2654

  • SSDEEP

    49152:IyDIihz4W7kvWDQA0wMe7TtCqNY0Wi7zkxhb:Ij84WAvW10wMe7TtjY01Ix

Score
10/10
darkcometguest1discoveryevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest1

C2

Germanytop.no-ip.org:1604

Mutex

DC_MUTEX-GJGZ65W

Attributes
  • InstallPath

    Local\Temp\wvrss.exe

  • gencode

    cadhLisrwVbS

  • install

    true

  • offline_keylogger

    true

  • password

    sexyadmin

  • persistence

    false

  • reg_key

    WindowsFirewall

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ab17dc92cf4aa8230d6fac5931d9564_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4ab17dc92cf4aa8230d6fac5931d9564_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\plugtemp\svchost.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Users\Admin\AppData\Roaming\Local\Temp\wvrss.exe
        "C:\Users\Admin\AppData\Roaming\Local\Temp\wvrss.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe
    Filesize

    1.1MB

    MD5

    d881de17aa8f2e2c08cbb7b265f928f9

    SHA1

    08936aebc87decf0af6e8eada191062b5e65ac2a

    SHA256

    b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

    SHA512

    5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

    Download Submit

  • memory/1052-0-0x0000000000400000-0x00000000007B6000-memory.dmp

    Filesize

    3.7MB

    Download

  • memory/1052-74-0x0000000000400000-0x00000000007B6000-memory.dmp

    Filesize

    3.7MB

    Download

  • memory/2024-6-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2024-3-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2024-8-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2024-70-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

    Download