Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2024 10:26

General

  • Target

    d1f834a0abe1adad23eb99e9d877e8f6_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    d1f834a0abe1adad23eb99e9d877e8f6

  • SHA1

    06047d238c3e5ca4a56a776e03148b4aba5ec842

  • SHA256

    1f665d378d61b7030eca36e761d508c5e98197d54c4b4501ea975a6682b134b2

  • SHA512

    8d2c9ad9ebf47c75d6b72e95875d00428ca5476ec74dbd536a2d67af1b7ac2ec83f60cc08dbe1f8f59d2e6326b26f227c732321e744a9b666ec67fa0640e4ac5

  • SSDEEP

    12288:Na6snd3as6YqYN3/Ry/NdMvQH5M8bKUA0i3PFbxNrOwcxDdArCbnIc4N/HbkGgL/:NviYDCNN5eDdArCjm0P48HZyNwcphW

Malware Config

Extracted

Family

darkcomet

Botnet

Crypted

C2

jesusmanwoohoo.no-ip.org:1604

Mutex

DC_MUTEX-EW8ANM5

Attributes
  • gencode

    SDj8iuYh55Bf

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1f834a0abe1adad23eb99e9d877e8f6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d1f834a0abe1adad23eb99e9d877e8f6_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4148
    • C:\Users\Admin\AppData\Roaming\MTvEmAGhp.exe
      "C:\Users\Admin\AppData\Roaming\MTvEmAGhp.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2224
    • C:\Users\Admin\AppData\Local\Temp\d1f834a0abe1adad23eb99e9d877e8f6_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d1f834a0abe1adad23eb99e9d877e8f6_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Users\Admin\AppData\Roaming\MTvEmAGhp.exe
        "C:\Users\Admin\AppData\Roaming\MTvEmAGhp.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\MTvEmAGhp.exe.log

    Filesize

    20B

    MD5

    b3ac9d09e3a47d5fd00c37e075a70ecb

    SHA1

    ad14e6d0e07b00bd10d77a06d68841b20675680b

    SHA256

    7a23c6e7ccd8811ecdf038d3a89d5c7d68ed37324bae2d4954125d9128fa9432

    SHA512

    09b609ee1061205aa45b3c954efc6c1a03c8fd6b3011ff88cf2c060e19b1d7fd51ee0cb9d02a39310125f3a66aa0146261bdee3d804f472034df711bc942e316

  • C:\Users\Admin\AppData\Roaming\MTvEmAGhp.exe

    Filesize

    4KB

    MD5

    5f9464c4385ac08f48cd0263278dbe0d

    SHA1

    36201364ddc828fb2127495ff7702e3fc5dbad66

    SHA256

    958cdfbb0798de864a34c2c312fec94cc96524cda33695e459ee6d1f6cc14b13

    SHA512

    26bb4a0e9cc4411f39ab1137dc61ea7e8b125d2234e7a355f7195812d63048d0bd785a5a85601521d24e6cd35519acda9645960307359be56da9f1ad19673667

  • memory/2224-47-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/2224-24-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/2224-23-0x0000000074E92000-0x0000000074E93000-memory.dmp

    Filesize

    4KB

  • memory/2296-49-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/2296-25-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/3292-0-0x0000000074E92000-0x0000000074E93000-memory.dmp

    Filesize

    4KB

  • memory/3292-42-0x0000000074E92000-0x0000000074E93000-memory.dmp

    Filesize

    4KB

  • memory/3292-2-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/3292-1-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/3292-44-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/3292-43-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/3960-29-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-3-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-4-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-53-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-19-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-5-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-45-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-61-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-16-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-46-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-18-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-54-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-55-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-56-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-58-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4148-8-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB