Overview

overview

10

Static

static

3

1f36ae9c54...18.exe

windows7-x64

10

1f36ae9c54...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02-07-2024 11:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f36ae9c549463f85413f1f79c0c5886_JaffaCakes118.exe

  • Size

    630KB

  • MD5

    1f36ae9c549463f85413f1f79c0c5886

  • SHA1

    d4c413853c03dd17acaada4c1d46195e57cb9017

  • SHA256

    351b67cd53a80350ea7d34f069e85a2e4cb4d8050ef00f1e4a994f04326c78af

  • SHA512

    e54ac588bcba670fe0d3dbbf21768cfa2c1af799c4fc9d2f16d01efbb0697fbf63eaa7ae16ac26e1ef31a1cb247eb6ce63f923dab0ab0d9efe9d3db20852b76c

  • SSDEEP

    12288:v5kJ7Mj7pvwIQRdVoZ9NVlfndzfiX6gIGPQG+U:v5C4jVvW89N7fndzfpgFQG+

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f36ae9c549463f85413f1f79c0c5886_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1f36ae9c549463f85413f1f79c0c5886_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C cd C:\Users\Admin\AppData\Roaming\ &&ren *.zgy *.exe && exit
      2⤵
        PID:624
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MTemp104.vbs"
        2⤵
        • Adds Run key to start application
        PID:1908
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2724
      • C:\Users\Admin\AppData\Local\Temp\nSClearText.exe
        C:\Users\Admin\AppData\Local\Temp\nSClearText.exe
        2⤵
        • Executes dropped EXE
        PID:2620
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2004

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Scripting

    1
    T1064

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\MTemp104.vbs
      Filesize

      429B

      MD5

      d4d3eb4e97c7387695972b24915e7530

      SHA1

      087ba0cdd68b4cd6bae40b81935c0d273a1a97bd

      SHA256

      f5b3191cb17353ca70f772b6208d26d04ba18076a709c20990836f75ee27a638

      SHA512

      a9709a5552d7013fe28bfc1d3dc8479108377a14c1b131390747a6a80e25def6161f79fa8a9bd2179ee70f9dd1a212d940a28e3bd8dbd5165b552a191e1de8ac

      Download Submit
    • C:\Users\Admin\AppData\Roaming\jdx.zgy
      Filesize

      630KB

      MD5

      1f36ae9c549463f85413f1f79c0c5886

      SHA1

      d4c413853c03dd17acaada4c1d46195e57cb9017

      SHA256

      351b67cd53a80350ea7d34f069e85a2e4cb4d8050ef00f1e4a994f04326c78af

      SHA512

      e54ac588bcba670fe0d3dbbf21768cfa2c1af799c4fc9d2f16d01efbb0697fbf63eaa7ae16ac26e1ef31a1cb247eb6ce63f923dab0ab0d9efe9d3db20852b76c

      Download Submit
    • memory/2004-44-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2004-40-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2024-0-0x0000000074631000-0x0000000074632000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2024-1-0x0000000074630000-0x0000000074BDB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2024-2-0x0000000074630000-0x0000000074BDB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2024-41-0x0000000074630000-0x0000000074BDB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2024-27-0x0000000074630000-0x0000000074BDB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2724-17-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-18-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2724-14-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-12-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-25-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-26-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-19-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-23-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-24-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download
    • memory/2724-9-0x0000000000400000-0x00000000004EB000-memory.dmp
      Filesize

      940KB

      Download