Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
29/03/2025, 18:31
General
-
Target
Minecraft Hacks.exe
-
Size
756KB
-
MD5
250b637a8ccbdc0361bbe73c353550e0
-
SHA1
778105f392905d3bacb707e1483d3d133b396dfe
-
SHA256
c5f6bee2224c266e2efc4fdce615994d14924c26fab05f25dde75e93b6aaa72b
-
SHA512
8b11342aca6aa51cc7f683c1b8a9cd1801d1a0e45d8e326a18916078721dd93a738dd6ab4c1ee1e60ccb88f7a6c1898f80d0238b373a3723bf1b224981c04603
-
SSDEEP
12288:49HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hYckni:sZ1xuVVjfFoynPaVBUR8f+kN10EBycP
Malware Config
Extracted
darkcomet
Guest16
forced.zapto.org:1604
DC_MUTEX-98NAYE1
-
gencode
f7qnJEEXeyEL
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft Hacks.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft Hacks.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
808KB
-
Filesize
4KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB