Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 03:54

General

  • Target

    f9fdd0d68dc69aabb134e1821171de5f_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    f9fdd0d68dc69aabb134e1821171de5f

  • SHA1

    727a86e1c524f0525539fbf70c22e7e9873de24a

  • SHA256

    1513469d47432259a0f44fa5279c294cb020eb41bd90dc2e7044d6ecb0845729

  • SHA512

    f90b67febe72caaae8f6a6fa994c689ff27eca0137aedd7cce4d754ad2023e92d6d28dc13a618322a112cc49924f82aee02da9fc5fff572bc6775f5f29ce14ad

  • SSDEEP

    12288:f/Bv17kMLTTTdfIX1y6hgpcKiaqb7MybKbeLSVNIYntkypxCJfFSzk+wDvCXP56a:ddshJMXiJo7jWy8a1VXiNhbnQ+

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9fdd0d68dc69aabb134e1821171de5f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f9fdd0d68dc69aabb134e1821171de5f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3580
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4748

Network

  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    9h0s7.no-ip.org
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    9h0s7.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    169.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    169.117.168.52.in-addr.arpa
    IN PTR
    Response
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 127.0.0.1:1604
    svchost.exe
  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    9h0s7.no-ip.org
    dns
    svchost.exe
    61 B
    121 B
    1
    1

    DNS Request

    9h0s7.no-ip.org

  • 8.8.8.8:53
    169.117.168.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    169.117.168.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    1.1MB

    MD5

    d881de17aa8f2e2c08cbb7b265f928f9

    SHA1

    08936aebc87decf0af6e8eada191062b5e65ac2a

    SHA256

    b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

    SHA512

    5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

  • memory/3580-18-0x0000000074B70000-0x0000000075121000-memory.dmp

    Filesize

    5.7MB

  • memory/3580-1-0x0000000074B70000-0x0000000075121000-memory.dmp

    Filesize

    5.7MB

  • memory/3580-2-0x0000000074B70000-0x0000000075121000-memory.dmp

    Filesize

    5.7MB

  • memory/3580-0-0x0000000074B72000-0x0000000074B73000-memory.dmp

    Filesize

    4KB

  • memory/4748-20-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/4748-23-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-12-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-15-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/4748-17-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-16-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-10-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-7-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-19-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-21-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-22-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-14-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-24-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-25-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-26-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-27-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-28-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-29-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-30-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-31-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-32-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4748-33-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.