Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
18/02/2025, 19:31
General
-
Target
JaffaCakes118_014c7d1e8c7312feb569be30c1d79987.exe
-
Size
539KB
-
MD5
014c7d1e8c7312feb569be30c1d79987
-
SHA1
7b05fe638f03cfe8a64380fed1335d46119a7773
-
SHA256
69aaaf8422682178ae9368bfb4ee44814a37edd1bb2d61c8f7d9547fa0996236
-
SHA512
0ce51d96698ca03aa905bcd6c5640e105fbe148c718cdf522930d00177ed49bcf189bb87bb0c1a06cee3ac16f6727b5248d5b083465744ca7e260e3a293da5ff
-
SSDEEP
12288:FPi7x3wWDpFiFfjJLeBQSVXRSid+ffd3DmBe+1zjDfniw+We:F8BFpgJ25Idz6ddWwA
Malware Config
Extracted
darkcomet
FUD1
127.0.0.1:1604
DC_MUTEX-THMQ1D3
-
gencode
QkTZNRW8YUpJ
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_014c7d1e8c7312feb569be30c1d79987.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_014c7d1e8c7312feb569be30c1d79987.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ddd.com"C:\Users\Admin\AppData\Roaming\ddd.com"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD5912bf8de243a87768f93748724f57b4a
SHA1a547cbac52a9f37a9cb9a73ae20f4fe812a341d6
SHA256300599c3a636281b24fbae8ebe9f0921645ae65c29141e0ce868753056e47c38
SHA51264389edf2aa1bf96dd6a9fd042de5863e2d163e17c16f54aec680e589ddc39ed82476037c73a5ec291e9e05309b8d94fdf93d00c906bbf2894bb08d7d95d11b5
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
5.7MB
-
Filesize
4KB