Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2025, 03:20

General

  • Target

    JaffaCakes118_31412729528ff5bc80c5582bbe784628.exe

  • Size

    315KB

  • MD5

    31412729528ff5bc80c5582bbe784628

  • SHA1

    26bc7dc6a6d763a96925f41f34d78ca6157ee4fc

  • SHA256

    1e1fe04cd20a5b8b47be1188c98ce2979b4c56257967f3bff3218a194b9d5efb

  • SHA512

    3628cc231e19dfaa66466d17b02db07967cad08068a57e002c4bd070490232d2450848ac0d2fa900553f108abc8ef0691c11b2109b5034ba21014790e072847b

  • SSDEEP

    6144:LSTv34CFfifD2gVKVTQQ249HZ52KTh9XKOCgLJacj5/AZtRsO:LEPXgr8VMQDT52WXKq9fj5/AZjv

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

fugitif.no-ip.org:2702

Mutex

DC_MUTEX-GJKJZWL

Attributes
  • InstallPath

    driver\winupdate.exe

  • gencode

    EQ=TzK#norn1

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31412729528ff5bc80c5582bbe784628.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31412729528ff5bc80c5582bbe784628.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31412729528ff5bc80c5582bbe784628.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31412729528ff5bc80c5582bbe784628.exe
        3⤵
        • Modifies WinLogon for persistence
        • Checks BIOS information in registry
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          4⤵
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1376
        • C:\driver\winupdate.exe
          "C:\driver\winupdate.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3144
          • C:\driver\winupdate.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2544
            • C:\driver\winupdate.exe
              6⤵
              • Modifies firewall policy service
              • Windows security bypass
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\driver\winupdate.exe

    Filesize

    315KB

    MD5

    31412729528ff5bc80c5582bbe784628

    SHA1

    26bc7dc6a6d763a96925f41f34d78ca6157ee4fc

    SHA256

    1e1fe04cd20a5b8b47be1188c98ce2979b4c56257967f3bff3218a194b9d5efb

    SHA512

    3628cc231e19dfaa66466d17b02db07967cad08068a57e002c4bd070490232d2450848ac0d2fa900553f108abc8ef0691c11b2109b5034ba21014790e072847b

  • memory/216-6-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/216-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1376-24-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1376-22-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1376-90-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1892-12-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1892-5-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1892-3-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2544-94-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2544-108-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3144-97-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3144-91-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/4076-110-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-104-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-122-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-121-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-120-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-119-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-118-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-102-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-101-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-100-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-103-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-117-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-107-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-106-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-105-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-116-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-111-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-115-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-112-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-113-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4076-114-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-9-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-18-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-11-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-14-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-16-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-15-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-17-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/4624-83-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB