Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
29-01-2025 08:19
General
-
Target
JaffaCakes118_54ad41a42e0c7ee4443a9be89ca534fe.exe
-
Size
756KB
-
MD5
54ad41a42e0c7ee4443a9be89ca534fe
-
SHA1
93d216cef8b1682cf14d8ddbd1c8cdbfc447c57c
-
SHA256
7ae251af1210de14be1b1729c5d8a5912d0abbd0279f05eab5acaf62d5cded51
-
SHA512
24581127ec38af7ca0e0b0378bcc649bb9c460b4d3cae4077d856f59477661023343c8be2364d6990e6359ec61fdebd8dd040b934cac4acff8c34ceee734d9e2
-
SSDEEP
12288:z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hisvvd:9Z1xuVVjfFoynPaVBUR8f+kN10EBbvvd
Malware Config
Extracted
darkcomet
Guest16
appelsap.no-ip.org:86
DC_MUTEX-KFF0744
-
InstallPath
LocalUpdates\Updater.exe
-
gencode
oqbAtc4bt3Sc
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
UpdateSteamCrack
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54ad41a42e0c7ee4443a9be89ca534fe.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54ad41a42e0c7ee4443a9be89ca534fe.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\LocalUpdates\Updater.exe"C:\Windows\system32\LocalUpdates\Updater.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD554ad41a42e0c7ee4443a9be89ca534fe
SHA193d216cef8b1682cf14d8ddbd1c8cdbfc447c57c
SHA2567ae251af1210de14be1b1729c5d8a5912d0abbd0279f05eab5acaf62d5cded51
SHA51224581127ec38af7ca0e0b0378bcc649bb9c460b4d3cae4077d856f59477661023343c8be2364d6990e6359ec61fdebd8dd040b934cac4acff8c34ceee734d9e2
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
4KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
4KB
-
Filesize
808KB