Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    01/03/2025, 20:17

General

  • Target

    JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe

  • Size

    658KB

  • MD5

    3b549ca77da9836e659cff04c765cba0

  • SHA1

    d9a9ad224df713d00242284c6409c225c1e5e9f6

  • SHA256

    94b18bddde9eab999dfa8877ea093db4780e5e5e73b53e727290e145e93af37c

  • SHA512

    fc836ebb4fa0f4fff813bbd349cd5fcdbb5248acede03a38f6b5c0f4d04e0bbf2506cfb16c6883a5b99978946aeae8d6a407e0b08f7be47a98d2c612266de06b

  • SSDEEP

    12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h0:WZ1xuVVjfFoynPaVBUR8f+kN10EBm

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

hackertoday.no-ip.biz:1604

Mutex

DC_MUTEX-L7PC5P8

Attributes
  • gencode

    25KoFNG9yLPg

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2016-0-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2016-1-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-2-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-3-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-4-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-5-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-6-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-7-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-8-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-9-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-10-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-11-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-12-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-13-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2016-14-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB