Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
29-01-2025 13:39
General
-
Target
JaffaCakes118_577d3549b8fa6fb01ed245f80b93cc37.exe
-
Size
811KB
-
MD5
577d3549b8fa6fb01ed245f80b93cc37
-
SHA1
b84f3b77f909a83d18777a91f98ef97184549e00
-
SHA256
8ebeb8a6e65621b322065a05135e8f014c6c685f403544e02c221a6ac8540396
-
SHA512
5e70db8367d991bd989b1d33efc5b4101815da42e386fbfe90f30db4c2051d53dc854e915c72f693ac4666c6c5b5bd28d0eec27be258ea5d44883ab223b0ce6f
-
SSDEEP
12288:d9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/halYumbo:3Z1xuVVjfFoynPaVBUR8f+kN10EBs+o
Malware Config
Extracted
darkcomet
Guest16
7amza00.zapto.org:922
DC_MUTEX-EHWYY9U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
ZuS70S3vbaVz
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_577d3549b8fa6fb01ed245f80b93cc37.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_577d3549b8fa6fb01ed245f80b93cc37.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
960KB
-
Filesize
228KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
752KB
-
Filesize
960KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB