Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
22-02-2025 22:33
General
-
Target
JaffaCakes118_1cadb40bb61186f2e85313c1e96572d7.exe
-
Size
1.1MB
-
MD5
1cadb40bb61186f2e85313c1e96572d7
-
SHA1
2feebaaeffb1114f1c630139f5466b937951d17f
-
SHA256
de3665405a74bd3fd308b8831d55d8b86cd00f81126333de8dfdb9b26bc9fe4e
-
SHA512
e473b4d743072e77dc5e6ecd7bae9d51fe4cfdeb2a58fc24bbd834e9e6485dc5d4259d1530301169b8bb4e8e5ee1bcaaa141339fc43827bf2fe92ceec5c272cb
-
SSDEEP
24576:OvRkla+ipDfHGpY+7oY6A+mgzbGBUR39h/ii:2RSI/qTP6AOfTR39h/ii
Malware Config
Extracted
darkcomet
Guest16
94.102.63.198:1742
xcb222.no-ip.org:1742
DC_MUTEX-2AXT7EA
-
gencode
ooYEEUcSXUpB
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1cadb40bb61186f2e85313c1e96572d7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1cadb40bb61186f2e85313c1e96572d7.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\winupd.exe"C:\Users\Admin\AppData\winupd.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winlogon.exeC:\Users\Admin\AppData\Local\Temp\\winlogon.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
Filesize
451KB
MD53ae6a42edbb38ce65fd8b7130c1e7fd3
SHA1194d6dd4f841ffa7787629cd1426c1b49669f445
SHA256c81c0a2b3daeb5a80644bda9faeab26357dec3e4e0256d4a0088aae8e3ad5a6f
SHA512cd80f662f6986f11b40a7c0df35e237be3e4aec033c5c71e978d064ee63e01e73603e8fc28150685786b320f48186596d04ff5e192aded2de1cfeb526ad2b64c
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB