Analysis

  • max time kernel
    144s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    01/03/2025, 06:48

General

  • Target

    JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe

  • Size

    952KB

  • MD5

    3763edd1e6ad1bf573bc2d2190649a2c

  • SHA1

    9a9b772cdf1bbc1b9e4ada8435b9aa09f1a32cde

  • SHA256

    0684e126c70d34320ccae8547ebf1b4bb1aaf230f94c92d6c56e4877ffcec136

  • SHA512

    cacf3b0ad57193003b12e3e2409010280ae8f6fae8a84244ca0d9d97769a128fb27f0acec423e0f267461b4958df2b1736bb34d561e65898c1c2f7263d7a0ecd

  • SSDEEP

    24576:xfibWwLVMG7wJxnl7lQBX1GPZEuePxSt4YpqUQezetrO5:Rsji7lIlGBMPE1pqUQezuS5

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    P+ihDzmkisV�

  • install

    false

  • offline_keylogger

    false

  • password

    123456

  • persistence

    false

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
      2⤵
      • Modifies security service
      • Windows security bypass
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1984
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"
        3⤵
          PID:2868

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA

      Filesize

      599KB

      MD5

      f2271fe569c058dc724d9b9e53811e31

      SHA1

      ea276fc14127875413ac387f017bd2291a987f4b

      SHA256

      bf0074851e2435a255b512e502b831ed2c456774971f8fc57004d597769364a6

      SHA512

      c324428534f64879aa17b190206e538066308486d95e9fa1b8b7238bc79067042717c232034ef8926376b72d3123be169852b05bfe58c7f69887245d91e5b53d

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

      Filesize

      1.3MB

      MD5

      7e6451294f60b01af6b01716d961ff3d

      SHA1

      fd077d9fdee7976d9f4b3f1fc34e0d8b26113382

      SHA256

      385d12c46e7efe1715a7a24c2091f38c6a87f6b2abaa13371b5c0307a0c1eb46

      SHA512

      2995724a78d0cd69d21dbf616c589ae80171a905a36ece9da3990b3b33c1619d7d7bfa905137c8221ede7a3ac2d545879ae607786e2cc0cf1ba460f071d138b0

    • memory/1984-43-0x000007FEF65E0000-0x000007FEF65F1000-memory.dmp

      Filesize

      68KB

    • memory/1984-27-0x000007FEFAD50000-0x000007FEFAD84000-memory.dmp

      Filesize

      208KB

    • memory/1984-48-0x000007FEF4E00000-0x000007FEF5EB0000-memory.dmp

      Filesize

      16.7MB

    • memory/1984-57-0x000007FEF2D50000-0x000007FEF2ECA000-memory.dmp

      Filesize

      1.5MB

    • memory/1984-53-0x000007FEF4B90000-0x000007FEF4D10000-memory.dmp

      Filesize

      1.5MB

    • memory/1984-54-0x000007FEFADB0000-0x000007FEFADC0000-memory.dmp

      Filesize

      64KB

    • memory/1984-55-0x000007FEF2EF0000-0x000007FEF2F01000-memory.dmp

      Filesize

      68KB

    • memory/1984-29-0x000007FEFB660000-0x000007FEFB678000-memory.dmp

      Filesize

      96KB

    • memory/1984-31-0x000007FEFACB0000-0x000007FEFACC1000-memory.dmp

      Filesize

      68KB

    • memory/1984-28-0x000007FEF73A0000-0x000007FEF7656000-memory.dmp

      Filesize

      2.7MB

    • memory/1984-33-0x000007FEFABD0000-0x000007FEFABE1000-memory.dmp

      Filesize

      68KB

    • memory/1984-34-0x000007FEFABB0000-0x000007FEFABCD000-memory.dmp

      Filesize

      116KB

    • memory/1984-32-0x000007FEFABF0000-0x000007FEFAC07000-memory.dmp

      Filesize

      92KB

    • memory/1984-30-0x000007FEFACD0000-0x000007FEFACE7000-memory.dmp

      Filesize

      92KB

    • memory/1984-44-0x000007FEF65C0000-0x000007FEF65DB000-memory.dmp

      Filesize

      108KB

    • memory/1984-26-0x000000013F8F0000-0x000000013F9E8000-memory.dmp

      Filesize

      992KB

    • memory/1984-40-0x000007FEF7380000-0x000007FEF7398000-memory.dmp

      Filesize

      96KB

    • memory/1984-35-0x000007FEF5EB0000-0x000007FEF60BB000-memory.dmp

      Filesize

      2.0MB

    • memory/1984-56-0x000007FEF2ED0000-0x000007FEF2EE2000-memory.dmp

      Filesize

      72KB

    • memory/1984-51-0x000007FEF4D40000-0x000007FEF4D51000-memory.dmp

      Filesize

      68KB

    • memory/1984-39-0x000007FEFAA10000-0x000007FEFAA31000-memory.dmp

      Filesize

      132KB

    • memory/1984-46-0x000007FEF6580000-0x000007FEF6598000-memory.dmp

      Filesize

      96KB

    • memory/1984-45-0x000007FEF65A0000-0x000007FEF65B1000-memory.dmp

      Filesize

      68KB

    • memory/1984-42-0x000007FEF6600000-0x000007FEF6611000-memory.dmp

      Filesize

      68KB

    • memory/1984-41-0x000007FEF6620000-0x000007FEF6631000-memory.dmp

      Filesize

      68KB

    • memory/1984-47-0x000007FEF6550000-0x000007FEF6580000-memory.dmp

      Filesize

      192KB

    • memory/1984-38-0x000007FEF6640000-0x000007FEF6681000-memory.dmp

      Filesize

      260KB

    • memory/1984-37-0x000007FEFAB90000-0x000007FEFABA1000-memory.dmp

      Filesize

      68KB

    • memory/1984-36-0x000007FEF6690000-0x000007FEF66F7000-memory.dmp

      Filesize

      412KB

    • memory/1984-49-0x000007FEF4DE0000-0x000007FEF4DF7000-memory.dmp

      Filesize

      92KB

    • memory/1984-50-0x000007FEF4D60000-0x000007FEF4DDC000-memory.dmp

      Filesize

      496KB

    • memory/1984-52-0x000007FEF4D10000-0x000007FEF4D34000-memory.dmp

      Filesize

      144KB

    • memory/2792-25-0x0000000000400000-0x000000000055E000-memory.dmp

      Filesize

      1.4MB

    • memory/2792-58-0x0000000000400000-0x000000000055E000-memory.dmp

      Filesize

      1.4MB

    • memory/2868-13-0x000000013F8F0000-0x000000013F9E8000-memory.dmp

      Filesize

      992KB

    • memory/2868-15-0x000007FEFAD50000-0x000007FEFAD84000-memory.dmp

      Filesize

      208KB

    • memory/2868-19-0x000007FEFACB0000-0x000007FEFACC1000-memory.dmp

      Filesize

      68KB

    • memory/2868-16-0x000007FEF73A0000-0x000007FEF7656000-memory.dmp

      Filesize

      2.7MB

    • memory/2868-18-0x000007FEFACD0000-0x000007FEFACE7000-memory.dmp

      Filesize

      92KB

    • memory/2868-17-0x000007FEFB660000-0x000007FEFB678000-memory.dmp

      Filesize

      96KB