Overview

overview

10

Static

static

7

15ad62d680...18.exe

windows7-x64

10

15ad62d680...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 10:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15ad62d680dc9a102726839e40947cca_JaffaCakes118.exe

  • Size

    944KB

  • MD5

    15ad62d680dc9a102726839e40947cca

  • SHA1

    2c86c551936166fffa254ec476cf32819b983ee8

  • SHA256

    60813671d05bc0395d22388516b95cab683d03368fdcbfa5653b4aae9f1dc4ef

  • SHA512

    3060257623a248f3332f98168248a44c78829cf49d5f19ee4e5cc8dd8ec7cf506c483f4c3cfb2c8f25fb772ad31e739e1e49db15b1c1c930845caee560057970

  • SSDEEP

    24576:7uNkB2n5nfgrkrknV/uGTshqQgNBIBDTIUkMBtnxDQ:r2R2WkRuhhPgNSBDpXxDQ

Score
10/10
darkcometvicevasionratthemidatrojan

Malware Config

Extracted

Family

darkcomet

Botnet

vic

C2

samir9.no-ip.biz:1604

Mutex

DC_MUTEX-8L7F27W

Attributes
  • gencode

    EhW4Tz7tm6tv

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Themida packer 27 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15ad62d680dc9a102726839e40947cca_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\15ad62d680dc9a102726839e40947cca_JaffaCakes118.exe"
    1⤵
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2196-0-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-1-0x0000000000401000-0x000000000044F000-memory.dmp
    Filesize

    312KB

    Download
  • memory/2196-2-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-3-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-4-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-7-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-6-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-5-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-8-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-9-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-10-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-11-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-12-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-13-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-14-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-15-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-16-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-17-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-18-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-19-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-20-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-21-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-22-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-23-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-24-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-25-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-26-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2196-27-0x0000000000400000-0x0000000000618000-memory.dmp
    Filesize

    2.1MB

    Download