Overview

overview

10

Static

static

10

2fa59f06af...88.exe

windows7_x64

10

2fa59f06af...88.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fa59f06afb2e3c9bfa441137dbb4edeaec4c3c6ebf1fab6a7bf33cfa253a588

  • Size

    856KB

  • Sample

    200624-yee94zpw6a

  • MD5

    0241203fc5f46bb391c718d99aeb74fa

  • SHA1

    56d18760a6bb948c7887f40e3f3a1b8395b54672

  • SHA256

    2fa59f06afb2e3c9bfa441137dbb4edeaec4c3c6ebf1fab6a7bf33cfa253a588

  • SHA512

    bad9e676fc6c51c9d54e53f8e4966994b05451f39c5f2091a0c442e4c4ec78e05ffc8b9f3e3319b5df2d3706a75c2c0b2200875569e56e69f45c8c4e10a836b5

Score
10/10
darkcometportpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

PORT

C2

toxicwithahmet.duckdns.org:1604

Mutex

DC_MUTEX-7R6RAYW

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    CNR8TCZiNUeR

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      2fa59f06afb2e3c9bfa441137dbb4edeaec4c3c6ebf1fab6a7bf33cfa253a588

    • Size

      856KB

    • MD5

      0241203fc5f46bb391c718d99aeb74fa

    • SHA1

      56d18760a6bb948c7887f40e3f3a1b8395b54672

    • SHA256

      2fa59f06afb2e3c9bfa441137dbb4edeaec4c3c6ebf1fab6a7bf33cfa253a588

    • SHA512

      bad9e676fc6c51c9d54e53f8e4966994b05451f39c5f2091a0c442e4c4ec78e05ffc8b9f3e3319b5df2d3706a75c2c0b2200875569e56e69f45c8c4e10a836b5

    Score
    10/10
    darkcometpersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks