Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 03:44
General
-
Target
JaffaCakes118_45ef79cd0ffa77cc22a9267d7c69b280.exe
-
Size
232KB
-
MD5
45ef79cd0ffa77cc22a9267d7c69b280
-
SHA1
21e4b0ca17c5d670f6a996a21d51c4c78a84b17a
-
SHA256
6788136a4f604f96bf8fbbdc7796e9bf57c55c9e41587fb8c4e38f9c7e28de67
-
SHA512
783903c091a4e529d700d590ebc0ebc385cbc295917e4bd420a8e2f2adfb6214be4244ae141452735d4e35090e7946be9c10289700741bed969f251e9615e8b3
-
SSDEEP
6144:JjFy93LU92VxOtVflFud4TnxcpPTASCmqMorHwM095oS:VFy9bPQZlFjrG0ZmYbwjoS
Malware Config
Extracted
darkcomet
Guest16_min
192.168.2.102:1604
DCMIN_MUTEX-MYLE8DG
-
gencode
crFWbJBVKtvJ
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45ef79cd0ffa77cc22a9267d7c69b280.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45ef79cd0ffa77cc22a9267d7c69b280.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB