Analysis
- max time kernel
148s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
20/01/2025, 16:36
Behavioral task
behavioral1
Sample
JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
General
- Target JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe
- Size 448KB
- Sample250120-t4eawaymer
- SHA256 16181fddc28a16679199e91d57fec4ee7ecf2a8ab478783667960c69c446d410
- MD5 f0b8852c0b559264764e4b682e1c1117
- SHA1 13182e5f1c700f246d452d702a6b3d49417fbf53
- SHA512 7afc8b2509e61a623b4369e4b4d7c683945b3537bf661ac1480297e5147d445d7daee7200b9b0dadaa5cb766335c680bb3f2989d1b8edf9e6a3a8742571d4ca6
- SSDEEP 12288:NP4KfCRm47i/2Yku5upF1R36NaQ4ppnJN9IJaeh:VGHYkuspPRUQmJaO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
127.0.0.1:1604
Mutex
-
DC_MUTEX-1DN0ZPY
Attributes
-
gencode
pnkjqJ5i6PP5
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Darkcomet family
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1848 set thread context of 1776 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe 82 -
resource yara_rule behavioral2/memory/1848-0-0x0000000000400000-0x0000000000519000-memory.dmp upx behavioral2/memory/1776-2-0x0000000000400000-0x0000000000519000-memory.dmp upx behavioral2/memory/1848-4-0x0000000000400000-0x0000000000519000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeSecurityPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeTakeOwnershipPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeLoadDriverPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeSystemProfilePrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeSystemtimePrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeProfSingleProcessPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeIncBasePriorityPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeCreatePagefilePrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeBackupPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeRestorePrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeShutdownPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeDebugPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeSystemEnvironmentPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeChangeNotifyPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeRemoteShutdownPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeUndockPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeManageVolumePrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeImpersonatePrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeCreateGlobalPrivilege 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: 33 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: 34 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: 35 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: 36 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe Token: SeIncreaseQuotaPrivilege 1776 iexplore.exe Token: SeSecurityPrivilege 1776 iexplore.exe Token: SeTakeOwnershipPrivilege 1776 iexplore.exe Token: SeLoadDriverPrivilege 1776 iexplore.exe Token: SeSystemProfilePrivilege 1776 iexplore.exe Token: SeSystemtimePrivilege 1776 iexplore.exe Token: SeProfSingleProcessPrivilege 1776 iexplore.exe Token: SeIncBasePriorityPrivilege 1776 iexplore.exe Token: SeCreatePagefilePrivilege 1776 iexplore.exe Token: SeBackupPrivilege 1776 iexplore.exe Token: SeRestorePrivilege 1776 iexplore.exe Token: SeShutdownPrivilege 1776 iexplore.exe Token: SeDebugPrivilege 1776 iexplore.exe Token: SeSystemEnvironmentPrivilege 1776 iexplore.exe Token: SeChangeNotifyPrivilege 1776 iexplore.exe Token: SeRemoteShutdownPrivilege 1776 iexplore.exe Token: SeUndockPrivilege 1776 iexplore.exe Token: SeManageVolumePrivilege 1776 iexplore.exe Token: SeImpersonatePrivilege 1776 iexplore.exe Token: SeCreateGlobalPrivilege 1776 iexplore.exe Token: 33 1776 iexplore.exe Token: 34 1776 iexplore.exe Token: 35 1776 iexplore.exe Token: 36 1776 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1776 iexplore.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1776 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe 82 PID 1848 wrote to memory of 1776 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe 82 PID 1848 wrote to memory of 1776 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe 82 PID 1848 wrote to memory of 1776 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe 82 PID 1848 wrote to memory of 1776 1848 JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f0b8852c0b559264764e4b682e1c1117.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1776
-