Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-12-2024 20:31

General

  • Target

    f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    f08fc211cf36e9c208f2cad5ede21d3a

  • SHA1

    ef4a55a144149190d96fb3cbad17b1b558fda025

  • SHA256

    566f253412379e3b506b9140357109128b4fbda71bebcdcefdf479b1215a7647

  • SHA512

    a984a3a58512ef16ab42bdc8d1f97003da459300f5826a1de07cf99c07118ea387bde72c386785fabad0d279a5d74c71235b0be55573a18db750eb87211fd7af

  • SSDEEP

    24576:+ICEgHEFDPPBMQSzIp4CQOHcLLxzLc9Qi/Qtv4jNAM8cAFhVlrYzv5/kxIq47:mIM7OmzLc9zQ+jCJZDlrYd/kOq47

Malware Config

Extracted

Family

darkcomet

Botnet

Were all gonna miss you.

C2

thepwnman.no-ip.biz:3131

Mutex

Goodbye DC </3

Attributes
  • gencode

    JY7xRluxnMpG

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Users\Admin\AppData\Local\Temp\1514830460.exe
      "C:\Users\Admin\AppData\Local\Temp\1514830460.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Users\Admin\AppData\Local\Temp\nso8336.tmp\ins5.exe
        C:\Users\Admin\AppData\Local\Temp\nso8336.tmp\ins5.exe 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe /t /dT131981425S /e10111414 /u515ea7b2-cf8c-475e-aa01-18d35bc06f2f
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Users\Admin\AppData\Local\Temp\nso8336.tmp\515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe
          "C:\Users\Admin\AppData\Local\Temp\nso8336.tmp\515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe" /t /dT131981425S /e10111414 /u515ea7b2-cf8c-475e-aa01-18d35bc06f2f
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1784
    • C:\Users\Admin\AppData\Local\Temp\temp_SngmOgOQVr\vbc.exe
      "C:\Users\Admin\AppData\Local\Temp\temp_SngmOgOQVr\vbc.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso8336.tmp\515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe

    Filesize

    250KB

    MD5

    035e4f28801f8a2f5c9a51750b1d8bc0

    SHA1

    6083a072e75b146941dc759796e1b539fd4846db

    SHA256

    46dd0dcd46ed04a5819e21810339dc160a28c6d77a12661549d4a6875c4312be

    SHA512

    b5f0b19672c425d5025411bb0bfb9f604723bf11ba0a04b202330d2675655e1b7cb31bd51314d77f000edb668307fcf9661e20d12238e2095961cb0b1277d945

  • C:\Users\Admin\AppData\Local\Temp\nso8336.tmp\ins5.exe

    Filesize

    214KB

    MD5

    081f1ef743489a25c99fdd25f6d4f70d

    SHA1

    dfdbd1caf714644f6c1b1b383f717028c39a2db0

    SHA256

    ed6b25ef9345aa31303cdc1cad322b1607eda3bf7bfefe7445105baddd59c635

    SHA512

    bf2962affa9ffb92cbaa17389a71b6ecf548cf6629237444a4b078bdcbd29cdd825055e2fe49530053c864bb1ad42726c083bb7db6d20b0afc939363365ec4ca

  • \Users\Admin\AppData\Local\Temp\1514830460.exe

    Filesize

    270KB

    MD5

    b45b5fc64a61707e0e490d1e2c54e931

    SHA1

    eca8079aaf349e100a2852e2fbc6bbdc57d49f1f

    SHA256

    2769b2c94dadea227bc4a13af827007613185f3febeebd42cd501ffaeb5f595b

    SHA512

    ed7f31cd5ae1691fe7d90ae5110b841d56651935b16e1f3637cb05a0500c6cd7b67f78abfd6c5f4c09bdc4b8bb79d0352e4346c891255344b9b8469611b8ffc9

  • \Users\Admin\AppData\Local\Temp\nso8336.tmp\nsExec.dll

    Filesize

    8KB

    MD5

    249ae678f0dac4c625c6de6aca53823a

    SHA1

    6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

    SHA256

    7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

    SHA512

    66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

  • \Users\Admin\AppData\Local\Temp\temp_SngmOgOQVr\vbc.exe

    Filesize

    1.1MB

    MD5

    34aa912defa18c2c129f1e09d75c1d7e

    SHA1

    9c3046324657505a30ecd9b1fdb46c05bde7d470

    SHA256

    6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

    SHA512

    d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

  • memory/2680-45-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-67-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-44-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-26-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-42-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2680-38-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-36-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-34-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-32-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-30-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-28-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-24-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-75-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-47-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-48-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-74-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-73-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-72-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-61-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-62-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-63-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-64-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-65-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-66-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-71-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-68-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-69-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2680-70-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2732-60-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2892-2-0x00000000749D0000-0x0000000074F7B000-memory.dmp

    Filesize

    5.7MB

  • memory/2892-56-0x00000000749D0000-0x0000000074F7B000-memory.dmp

    Filesize

    5.7MB

  • memory/2892-1-0x00000000749D0000-0x0000000074F7B000-memory.dmp

    Filesize

    5.7MB

  • memory/2892-0-0x00000000749D1000-0x00000000749D2000-memory.dmp

    Filesize

    4KB