Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-10-2024 08:51
General
-
Target
7e8c2283a368a8d59b6eb8e387ca37c7_JaffaCakes118.exe
-
Size
349KB
-
MD5
7e8c2283a368a8d59b6eb8e387ca37c7
-
SHA1
8a70966d567a71f0cdedaea76eccb552f2cdb5e2
-
SHA256
e19aeb266d9de9eb06aa82e6d36176a6a210e6e6cc3560615a6577e506c13058
-
SHA512
70f07c38375cfc960f5bf4305dc07454d060a5cac849d268619d8b5a68a957a1297f163c91499a2d72f6a438d1ad6fb3d64473fc5ebf3f3c95bfb3971cd50347
-
SSDEEP
6144:XcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37/l:XcW7KEZlPzCy37t
Malware Config
Extracted
darkcomet
HAHAHA
hurt2101.no-ip.info:3333
asdasd-Z370UQT
-
gencode
rHYez9mnV9Pc
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e8c2283a368a8d59b6eb8e387ca37c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7e8c2283a368a8d59b6eb8e387ca37c7_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
928KB
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB