Overview

overview

Static

static

1a42d231b4...c8.exe

windows7_x64

1a42d231b4...c8.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8

  • Size

    755KB

  • Sample

    210228-9rdcmpby8a

  • MD5

    2641515da5144daf7c7058dbff699a23

  • SHA1

    d16ad4ecb43e0294e51ad6b8341cb973b957c7e6

  • SHA256

    1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8

  • SHA512

    81d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576

Score
10/10
darkcometbootkitevasionpersistenceransomwarerattrojanupx

Malware Config

Targets

    • Target

      1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8

    • Size

      755KB

    • MD5

      2641515da5144daf7c7058dbff699a23

    • SHA1

      d16ad4ecb43e0294e51ad6b8341cb973b957c7e6

    • SHA256

      1a42d231b435bfc734280c5f42764bf32f4d8cfb6a6e6e22ae9d577c9f3720c8

    • SHA512

      81d5d23c6eda42dd4c0bda3dbf5df76198669e72fde6a4de8e769c66285806050e208f32f72fa781d4c9e4709250cb13ce5ee67f99bd695869fd060943caf576

    Score
    10/10
    darkcometevasionpersistencerattrojanupxbootkitransomware

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks