Overview

overview

10

Static

static

f6cad4b6b0...4e.exe

windows7_x64

10

f6cad4b6b0...4e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e

  • Size

    354KB

  • Sample

    201110-rt5q4phpw2

  • MD5

    77761a1080c4b0b32f59254414490f67

  • SHA1

    6bc2da22ab25b8eee137cff621f970ac28deffe0

  • SHA256

    f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e

  • SHA512

    48ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d

Score
10/10
darkcomet06-11-2020evasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

06-11-2020

C2

LAMIA-41739.portmap.io:41739

karmina113.sytes.net:7777

karmina200.sytes.net:7777
Mutex

DC_MUTEX-R9E2RDG

Attributes
  • InstallPath

    svchost\svchost.exe

  • gencode

    dneJWn9fFTdt

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e

    • Size

      354KB

    • MD5

      77761a1080c4b0b32f59254414490f67

    • SHA1

      6bc2da22ab25b8eee137cff621f970ac28deffe0

    • SHA256

      f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e

    • SHA512

      48ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d

    Score
    10/10
    darkcomet06-11-2020evasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks