Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 02:32
General
-
Target
JaffaCakes118_016e0e8eefb76dfdc4e7abcd1fc8af9a.exe
-
Size
722KB
-
MD5
016e0e8eefb76dfdc4e7abcd1fc8af9a
-
SHA1
9ab0d8fcd35feafa6f26947ea224f8b5e43907a2
-
SHA256
6db8928ccf1c6276eb0ba8dc51c3209df1d5d8d5a2f4f0559e4789f5244f77a8
-
SHA512
ddb8ed66e259f8a846a13c1cd1213182c8e169a10cb7cef2a1e91a31279f4c9c95baa89135b22e04ffc12e8fc9b7e459da260816d9ef05b249e5cfc488df6f9e
-
SSDEEP
12288:YFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJ8:43nbWmJVJFwSddIXvfhqbiaxvRxq9G
Malware Config
Extracted
latentbot
vpnservices021.zapto.org
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_016e0e8eefb76dfdc4e7abcd1fc8af9a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_016e0e8eefb76dfdc4e7abcd1fc8af9a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB