Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-10-2024 03:28
General
-
Target
7770e3d8036e0f1027d9581fdfee2407_JaffaCakes118.exe
-
Size
660KB
-
MD5
7770e3d8036e0f1027d9581fdfee2407
-
SHA1
dc059f9ac0c0fedfe9ff35b00800519e69954876
-
SHA256
81ea30180497515f2095134dfdf79319fcbeb6f6fd3529bd226ab6059336bbb7
-
SHA512
6dc1c7c1b9770304e4eec8301be7208fe9b83fb76d1958bde2915a29ec404905482480f3507a47d7c742a2978a8022b1dfaa05d4840976a4d14ff04a5bfd12f8
-
SSDEEP
12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UT:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jj
Malware Config
Extracted
darkcomet
Guest16_min
banyourmom.zapto.org:1337
DCMIN_MUTEX-7QDRQF8
-
gencode
hrWo28UzgQ2p
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7770e3d8036e0f1027d9581fdfee2407_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7770e3d8036e0f1027d9581fdfee2407_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB