Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/03/2025, 06:48

General

  • Target

    JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe

  • Size

    952KB

  • MD5

    3763edd1e6ad1bf573bc2d2190649a2c

  • SHA1

    9a9b772cdf1bbc1b9e4ada8435b9aa09f1a32cde

  • SHA256

    0684e126c70d34320ccae8547ebf1b4bb1aaf230f94c92d6c56e4877ffcec136

  • SHA512

    cacf3b0ad57193003b12e3e2409010280ae8f6fae8a84244ca0d9d97769a128fb27f0acec423e0f267461b4958df2b1736bb34d561e65898c1c2f7263d7a0ecd

  • SSDEEP

    24576:xfibWwLVMG7wJxnl7lQBX1GPZEuePxSt4YpqUQezetrO5:Rsji7lIlGBMPE1pqUQezuS5

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    P+ihDzmkisV�

  • install

    false

  • offline_keylogger

    false

  • password

    123456

  • persistence

    false

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
      2⤵
      • Modifies security service
      • Windows security bypass
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:232
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"
        3⤵
          PID:2928
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x248 0x44c
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1844

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA

      Filesize

      599KB

      MD5

      f2271fe569c058dc724d9b9e53811e31

      SHA1

      ea276fc14127875413ac387f017bd2291a987f4b

      SHA256

      bf0074851e2435a255b512e502b831ed2c456774971f8fc57004d597769364a6

      SHA512

      c324428534f64879aa17b190206e538066308486d95e9fa1b8b7238bc79067042717c232034ef8926376b72d3123be169852b05bfe58c7f69887245d91e5b53d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

      Filesize

      1.3MB

      MD5

      7e6451294f60b01af6b01716d961ff3d

      SHA1

      fd077d9fdee7976d9f4b3f1fc34e0d8b26113382

      SHA256

      385d12c46e7efe1715a7a24c2091f38c6a87f6b2abaa13371b5c0307a0c1eb46

      SHA512

      2995724a78d0cd69d21dbf616c589ae80171a905a36ece9da3990b3b33c1619d7d7bfa905137c8221ede7a3ac2d545879ae607786e2cc0cf1ba460f071d138b0

    • memory/232-32-0x00007FFCC3C60000-0x00007FFCC3C78000-memory.dmp

      Filesize

      96KB

    • memory/232-42-0x00007FFCBFD40000-0x00007FFCBFD61000-memory.dmp

      Filesize

      132KB

    • memory/232-71-0x00007FFCB24B0000-0x00007FFCB3560000-memory.dmp

      Filesize

      16.7MB

    • memory/232-35-0x00007FFCC3990000-0x00007FFCC39A7000-memory.dmp

      Filesize

      92KB

    • memory/232-41-0x00007FFCB24B0000-0x00007FFCB3560000-memory.dmp

      Filesize

      16.7MB

    • memory/232-34-0x00007FFCC39B0000-0x00007FFCC39C1000-memory.dmp

      Filesize

      68KB

    • memory/232-29-0x00007FF77CFA0000-0x00007FF77D098000-memory.dmp

      Filesize

      992KB

    • memory/232-38-0x00007FFCC0820000-0x00007FFCC0831000-memory.dmp

      Filesize

      68KB

    • memory/232-37-0x00007FFCC0840000-0x00007FFCC085D000-memory.dmp

      Filesize

      116KB

    • memory/232-31-0x00007FFCB4B90000-0x00007FFCB4E46000-memory.dmp

      Filesize

      2.7MB

    • memory/232-39-0x00007FFCB3560000-0x00007FFCB376B000-memory.dmp

      Filesize

      2.0MB

    • memory/232-40-0x00007FFCB4AF0000-0x00007FFCB4B31000-memory.dmp

      Filesize

      260KB

    • memory/232-30-0x00007FFCC4300000-0x00007FFCC4334000-memory.dmp

      Filesize

      208KB

    • memory/232-33-0x00007FFCC39D0000-0x00007FFCC39E7000-memory.dmp

      Filesize

      92KB

    • memory/232-36-0x00007FFCC38B0000-0x00007FFCC38C1000-memory.dmp

      Filesize

      68KB

    • memory/764-43-0x0000000000400000-0x000000000055E000-memory.dmp

      Filesize

      1.4MB

    • memory/764-28-0x0000000000400000-0x000000000055E000-memory.dmp

      Filesize

      1.4MB

    • memory/764-58-0x0000000000400000-0x000000000055E000-memory.dmp

      Filesize

      1.4MB

    • memory/764-73-0x0000000000400000-0x000000000055E000-memory.dmp

      Filesize

      1.4MB

    • memory/2928-17-0x00007FF77CFA0000-0x00007FF77D098000-memory.dmp

      Filesize

      992KB

    • memory/2928-18-0x00007FFCC4300000-0x00007FFCC4334000-memory.dmp

      Filesize

      208KB

    • memory/2928-20-0x00007FFCC3C60000-0x00007FFCC3C78000-memory.dmp

      Filesize

      96KB

    • memory/2928-21-0x00007FFCC39D0000-0x00007FFCC39E7000-memory.dmp

      Filesize

      92KB

    • memory/2928-22-0x00007FFCC39B0000-0x00007FFCC39C1000-memory.dmp

      Filesize

      68KB

    • memory/2928-19-0x00007FFCB4B90000-0x00007FFCB4E46000-memory.dmp

      Filesize

      2.7MB