Analysis
-
max time kernel
0s -
max time network
4s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29/03/2025, 18:21
General
-
Target
JaffaCakes118_9103394e428bf63d87620aee6ba1d209.exe
-
Size
687KB
-
MD5
9103394e428bf63d87620aee6ba1d209
-
SHA1
fcb5e6b70042d5badfc9e4ad8f5c844b286f5913
-
SHA256
dabe2af6daac473c4a6b321aa03d1064ebfaca772542b2ee882fb400746c057b
-
SHA512
88e480d681760165a5f2ccfd03d8bd6b25ee3f28d0abda1d05c750283f3cbb9c79644706c163be5a1f0ae3546e6195cce87a1e82846b8ebf958e33366303cb20
-
SSDEEP
12288:ZFf8Zo8N0CQ82o1gR9AilAVJ+q2Zn0f0Q4lkhI9SxzNs4k5:Z9OoM0L8HOeiOVgVW14YmS1Ns4k5
Malware Config
Extracted
darkcomet
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-WGL61C9
-
InstallPath
Windupdt\winupdate.exe
-
gencode
CgP9ATPpuVQg
-
install
true
-
offline_keylogger
true
-
password
Pa$$w0rd
-
persistence
true
-
reg_key
winupdater
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9103394e428bf63d87620aee6ba1d209.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9103394e428bf63d87620aee6ba1d209.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9103394e428bf63d87620aee6ba1d209.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
728KB