Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2025, 13:39

General

  • Target

    JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe

  • Size

    686KB

  • MD5

    2d949b68f4fde462b7f832505bb4adcd

  • SHA1

    aa6b039fb9710df1253fffc059503b30b906a99d

  • SHA256

    096bac70f86c28b91d8a57ee4352eda89355ad23010b83a893196bc0f9aa5e42

  • SHA512

    d74dda9bb8193725d68ea4de97a3b5ca19fa30c0f8325a6a4fda97dd7b801ccdf8d82fb43b355fdbabc26caa8b350ad671182ffa1b1d0c87176d7be29ab7f313

  • SSDEEP

    12288:+xrDbRiGMs7GTZD0LTuZBo1qpoK4YngtM9EgNkYMuoFmytIUlIkrMIAnmomce:+VfGVaK3o1sBYM9EoeFOwAmn

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

karakartal.no-ip.info:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    DDaab*PMH#3q

  • install

    true

  • offline_keylogger

    false

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Modifies firewall policy service
          • Modifies security service
          • Windows security bypass
          • Disables RegEdit via registry modification
          • Checks BIOS information in registry
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4816
      • C:\Windows\SysWOW64\ping.exe
        ping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4404-11-0x0000000000400000-0x00000000004AB000-memory.dmp

    Filesize

    684KB

  • memory/4404-13-0x0000000000400000-0x00000000004AB000-memory.dmp

    Filesize

    684KB

  • memory/4404-23-0x0000000000400000-0x00000000004AB000-memory.dmp

    Filesize

    684KB

  • memory/4816-24-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-30-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-27-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-28-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-29-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-26-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-25-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-22-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4972-5-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4972-17-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4972-7-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4972-2-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4972-6-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4972-4-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4972-3-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB