General
-
Target
JaffaCakes118_1fc518353098c49a6ab252fa057684d1
-
Size
970KB
-
Sample
250223-ksl2xa1ngm
-
MD5
1fc518353098c49a6ab252fa057684d1
-
SHA1
1515cda1755b0a420b13a67474714bde9c70ca23
-
SHA256
b87782b0ee08e7bc353bf485f7e5e1c22c1f206ef630bf365220131ff2ff8f61
-
SHA512
bcd4184c73750173a898e680a8add8b57e6d9ad882eaf24e91e353192e9e369fb19718162a30aac22fdb2306a49614f931d0ec20beb070ed15a28ce62ea706f9
-
SSDEEP
12288:Z4WecVucobJD6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhAx5Ni:ZzejFGAmBpVKHu0Mu9Xo20VGLVP5AxD
Behavioral task
behavioral1
Sample
JaffaCakes118_1fc518353098c49a6ab252fa057684d1.exe
Resource
win7-20240903-en
Malware Config
Extracted
darkcomet
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
Extracted
darkcomet
Guest16
173.88.59.69:1606
DC_MUTEX-PJY4F5K
-
InstallPath
MSDSVC\MSDSVC3.exe
-
gencode
�d7Z.t�sVpJf
-
install
true
-
offline_keylogger
false
-
persistence
false
-
reg_key
Microsoft SVC
Targets
-
-
Target
JaffaCakes118_1fc518353098c49a6ab252fa057684d1
-
Size
970KB
-
MD5
1fc518353098c49a6ab252fa057684d1
-
SHA1
1515cda1755b0a420b13a67474714bde9c70ca23
-
SHA256
b87782b0ee08e7bc353bf485f7e5e1c22c1f206ef630bf365220131ff2ff8f61
-
SHA512
bcd4184c73750173a898e680a8add8b57e6d9ad882eaf24e91e353192e9e369fb19718162a30aac22fdb2306a49614f931d0ec20beb070ed15a28ce62ea706f9
-
SSDEEP
12288:Z4WecVucobJD6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhAx5Ni:ZzejFGAmBpVKHu0Mu9Xo20VGLVP5AxD
-
Darkcomet family
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1