Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
23/03/2025, 18:37
General
-
Target
JaffaCakes118_87d508a22f47c97a5b2ec61236f99b00.exe
-
Size
745KB
-
MD5
87d508a22f47c97a5b2ec61236f99b00
-
SHA1
9bb0875720b1e722f10dd2c0ff79bef8b49cb84a
-
SHA256
2f86db7106f852e5f02043136c7160989d6c817eed76000a253ad75cc7cfcf8c
-
SHA512
797263419b5ea8ec65b723812252267141b36b59cedf0b3259690b3848767650b3b354541fa746c3639c400b02459d87bf7b1762c8c58679a3fec0594015f688
-
SSDEEP
12288:c6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfh:xAmBpVKHu0Mu9Xo20VGLVP5
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
test
C2
127.0.0.1:1604
Mutex
DC_MUTEX-7GHRCRH
Attributes
-
gencode
VKLv�aC*TpMc
-
install
false
-
offline_keylogger
false
-
persistence
false
rc4.plain
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_87d508a22f47c97a5b2ec61236f99b00.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_87d508a22f47c97a5b2ec61236f99b00.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB