Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-11-2024 13:09
General
-
Target
a7ff0324b2f22660c111b779074272da_JaffaCakes118.exe
-
Size
660KB
-
MD5
a7ff0324b2f22660c111b779074272da
-
SHA1
255cec275914389272e7e13813a6525102694599
-
SHA256
a42d764e6dbbacaed70eb6806019cb28783134280462fbbf0b2b6f768b605a73
-
SHA512
5ec4a120c5d6037ec0f4fcfc525f37e727e1cae1d39a90bb90c9ebcfa44dfeaccad02f024b3b05a45d0a83350d0b2d73a705ce04e2d3ff84eda8e5bc0c145fbb
-
SSDEEP
12288:gXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U1:mnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jl
Malware Config
Extracted
darkcomet
HF
joshfred.no-ip.biz:5555
DC_MUTEX-GXQM11T
-
gencode
xAD8TksJqjZB
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7ff0324b2f22660c111b779074272da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7ff0324b2f22660c111b779074272da_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB