Analysis
- max time kernel
139s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
11/03/2025, 10:42
Behavioral task
behavioral1
Sample
JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe
Resource
win7-20241023-en
windows7-x64
11 signatures
150 seconds
General
- Target JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe
- Size 553KB
- Sample250311-mrtfps1vft
- SHA256 fd7c2591a43f6ce189ba598dbf5f2b5b8e747f2273ba4801871e170877598e96
- MD5 64c86c07e98ce9422329859cf53c130b
- SHA1 198b3502fc463e07f69ca4afe3c4c484c015062d
- SHA512 4d73bfd71a19df7a5bb4ae64f2adb49dda3b26cd04a0f16640cdb5e384ee451c915c3cb3292ea65480d05f426bc9126be8bfa256b8a9a636aa5d70eb32897f17
- SSDEEP 12288:I7DB4/kkVaGjbirYdj3yMObokNTz4VGRKr7nZSc:0D6skVpfiMO0uTzS1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
hnoo0oody.zapto.org:1604
Mutex
-
DC_MUTEX-F54S21D
Attributes
-
gencode
6AbFF7Bh%6$2
-
install
false
-
offline_keylogger
true
-
persistence
false
rc4.plain
Signatures
- Darkcomet family
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3688 set thread context of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3596 set thread context of 3088 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 96 PID 3088 set thread context of 4736 3088 explorer.exe 97 -
resource yara_rule behavioral2/memory/3688-0-0x0000000000400000-0x00000000006CF000-memory.dmp upx behavioral2/memory/3688-7-0x0000000000400000-0x00000000006CF000-memory.dmp upx behavioral2/memory/3088-12-0x0000000000400000-0x00000000006CF000-memory.dmp upx behavioral2/memory/3088-15-0x0000000000400000-0x00000000006CF000-memory.dmp upx behavioral2/memory/3088-10-0x0000000000400000-0x00000000006CF000-memory.dmp upx behavioral2/memory/3088-21-0x0000000000400000-0x00000000006CF000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeSecurityPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeTakeOwnershipPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeLoadDriverPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeSystemProfilePrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeSystemtimePrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeProfSingleProcessPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeIncBasePriorityPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeCreatePagefilePrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeBackupPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeRestorePrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeShutdownPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeDebugPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeSystemEnvironmentPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeChangeNotifyPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeRemoteShutdownPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeUndockPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeManageVolumePrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeImpersonatePrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeCreateGlobalPrivilege 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: 33 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: 34 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: 35 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: 36 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe Token: SeIncreaseQuotaPrivilege 4736 explorer.exe Token: SeSecurityPrivilege 4736 explorer.exe Token: SeTakeOwnershipPrivilege 4736 explorer.exe Token: SeLoadDriverPrivilege 4736 explorer.exe Token: SeSystemProfilePrivilege 4736 explorer.exe Token: SeSystemtimePrivilege 4736 explorer.exe Token: SeProfSingleProcessPrivilege 4736 explorer.exe Token: SeIncBasePriorityPrivilege 4736 explorer.exe Token: SeCreatePagefilePrivilege 4736 explorer.exe Token: SeBackupPrivilege 4736 explorer.exe Token: SeRestorePrivilege 4736 explorer.exe Token: SeShutdownPrivilege 4736 explorer.exe Token: SeDebugPrivilege 4736 explorer.exe Token: SeSystemEnvironmentPrivilege 4736 explorer.exe Token: SeChangeNotifyPrivilege 4736 explorer.exe Token: SeRemoteShutdownPrivilege 4736 explorer.exe Token: SeUndockPrivilege 4736 explorer.exe Token: SeManageVolumePrivilege 4736 explorer.exe Token: SeImpersonatePrivilege 4736 explorer.exe Token: SeCreateGlobalPrivilege 4736 explorer.exe Token: 33 4736 explorer.exe Token: 34 4736 explorer.exe Token: 35 4736 explorer.exe Token: 36 4736 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 3088 explorer.exe 4736 explorer.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3688 wrote to memory of 3596 3688 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 90 PID 3596 wrote to memory of 3088 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 96 PID 3596 wrote to memory of 3088 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 96 PID 3596 wrote to memory of 3088 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 96 PID 3596 wrote to memory of 3088 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 96 PID 3596 wrote to memory of 3088 3596 JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe 96 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97 PID 3088 wrote to memory of 4736 3088 explorer.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64c86c07e98ce9422329859cf53c130b.exe"2⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4736
-
-
-