Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
17/04/2025, 21:02
General
-
Target
JaffaCakes118_bb241c277c45c844adf75adcbcbbca6f.exe
-
Size
745KB
-
MD5
bb241c277c45c844adf75adcbcbbca6f
-
SHA1
046daed4bf85b1a77a38cf729d5bc4c9316a5779
-
SHA256
29765c1401f4fbc04f47647f6803f91da64c74195f4dc88afdc285629a784a0b
-
SHA512
aa1a151f4d0ba70cbc249fbf58afc59cacbcc421ced082e76a533e1b461c21dbb9d74e701529157f1ced48b129d8ff4e6be082ca98745532bc90c1a1846dbdd8
-
SSDEEP
12288:O6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhyFIIhII:zAmBpVKHu0Mu9Xo20VGLVP5
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
127.0.0.1:1604
Mutex
DC_MUTEX-F54S21D
Attributes
-
gencode
�1h1$iQwcqLP
-
install
false
-
offline_keylogger
false
-
persistence
false
rc4.plain
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb241c277c45c844adf75adcbcbbca6f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb241c277c45c844adf75adcbcbbca6f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB