General

  • Target

    45dabf6585b647a7af4df6dd5007701b

  • Size

    252KB

  • Sample

    201117-rr5swxcsk6

  • MD5

    5c436179724fd82d1c46c090f29a916a

  • SHA1

    fa95bcede5fd820a786958c2d88dec72a6231a60

  • SHA256

    578db85e5915bdc1b5b216892c102885a785dba582eb1dc9484d09804b9c2c09

  • SHA512

    05b91de9df9acabc0b7862d560afb0a8087ee20eb518c827d65eb093d5bae50d0ba8601c8e5931dcda1911f2b04c843844641a96941e0a70696c849843710674

Malware Config

Extracted

Family

darkcomet

Botnet

is

C2

hlopvp.ddns.net:1604

Mutex

DC_MUTEX-BZ014LX

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    K9K3tKtdM1Fc

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    ercsObject

Targets

    • Target

      45dabf6585b647a7af4df6dd5007701b

    • Size

      252KB

    • MD5

      5c436179724fd82d1c46c090f29a916a

    • SHA1

      fa95bcede5fd820a786958c2d88dec72a6231a60

    • SHA256

      578db85e5915bdc1b5b216892c102885a785dba582eb1dc9484d09804b9c2c09

    • SHA512

      05b91de9df9acabc0b7862d560afb0a8087ee20eb518c827d65eb093d5bae50d0ba8601c8e5931dcda1911f2b04c843844641a96941e0a70696c849843710674

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks