Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2024 11:41

General

  • Target

    e635cf1f967e29ea6078f4a5491b4b89_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    e635cf1f967e29ea6078f4a5491b4b89

  • SHA1

    6faf30de2b4b1e198650bfa9aa054ceece5e8a2a

  • SHA256

    a56e1e7aad8332d9e8a2b349548599ff11b6c27e576a627b2ec9d822964970a0

  • SHA512

    9e8e26a437355e1fdf2ec0f621bd32b10cccf74886ab5631396bf668ffdcabf2635b81e23c930f26b55be988a84af73cf79801eed362fb4244f72bcf4b39ec3e

  • SSDEEP

    24576:XarjK0uR6rw4Sp/rhEBjhOJcc5eJ0dpnMiQi6U6lCT4dvzR:XRmB4pnBHOO4dbR

Malware Config

Extracted

Family

darkcomet

Botnet

BC

C2

me.codeunix.net:8443

Mutex

DC_MUTEX-W4J6FQN

Attributes
  • gencode

    rVV8XaKZqPHj

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e635cf1f967e29ea6078f4a5491b4b89_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e635cf1f967e29ea6078f4a5491b4b89_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Users\Admin\AppData\Local\Temp\firefox.exe
      "C:\Users\Admin\AppData\Local\Temp\firefox.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2108
    • C:\Users\Admin\AppData\Local\Temp\AppLunch\vbc.exe
      C:\Users\Admin\AppData\Local\Temp\\AppLunch\vbc.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AppLunch\vbc.exe

    Filesize

    1.1MB

    MD5

    d881de17aa8f2e2c08cbb7b265f928f9

    SHA1

    08936aebc87decf0af6e8eada191062b5e65ac2a

    SHA256

    b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

    SHA512

    5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

  • C:\Users\Admin\AppData\Local\Temp\firefox.exe

    Filesize

    898KB

    MD5

    c8d28f8b498cadbb9445ac4545bd41b7

    SHA1

    b0efe230c29e5545b73dcc6dea472b7725353812

    SHA256

    fb013cbcbfe22507dc4bbbc60267f5c28c749dfc04b6808c9870588ec816521d

    SHA512

    69d38dab476f552db08683038db9934601c7aed45602499cec02ca899d1779d8e14c831e3fff2a05b88690f327b65231cc7c907a9a3b24148d7ffe23dcfe060d

  • memory/3436-40-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-47-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-34-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-21-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-46-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-25-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-28-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-26-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-31-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-30-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-29-0x00000000006C0000-0x00000000006C1000-memory.dmp

    Filesize

    4KB

  • memory/3436-45-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-44-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-43-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-42-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-36-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-37-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-38-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-39-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-35-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/3436-41-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4500-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

    Filesize

    4KB

  • memory/4500-3-0x00000000748C0000-0x0000000074E71000-memory.dmp

    Filesize

    5.7MB

  • memory/4500-2-0x00000000748C0000-0x0000000074E71000-memory.dmp

    Filesize

    5.7MB

  • memory/4500-32-0x00000000748C2000-0x00000000748C3000-memory.dmp

    Filesize

    4KB

  • memory/4500-1-0x00000000748C0000-0x0000000074E71000-memory.dmp

    Filesize

    5.7MB

  • memory/4500-33-0x00000000748C0000-0x0000000074E71000-memory.dmp

    Filesize

    5.7MB