Overview

overview

10

Static

static

Подкл...dr.exe

windows7_x64

10

Подкл...dr.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Подключение к Cheater HAer VPsu202epdr.exe

  • Size

    1.2MB

  • Sample

    210429-vp1d4l6sg6

  • MD5

    89819d45a907c55d273e9d4e2a64f2a9

  • SHA1

    18db069eb82c31af3cb577ea392e4b42775d37f4

  • SHA256

    e50cf3f7139ac7f4924b835334a98f7c426b66d0d19e986d885bd4080433d7bd

  • SHA512

    bb2eee52e673c8e2ae44c60f0df8dc69890df2108f5278f1928f207055d5e8660fd8d8eaab9d67ee3ed950574184cbc94af77d831b601323afc31d715b9ec248

Score
10/10
darkcometguest16persistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

radgoodnow.mooo.com:7777

Mutex

DC_MUTEX-0E720ZB

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    ReysmuLVc5ah

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      Подключение к Cheater HAer VPsu202epdr.exe

    • Size

      1.2MB

    • MD5

      89819d45a907c55d273e9d4e2a64f2a9

    • SHA1

      18db069eb82c31af3cb577ea392e4b42775d37f4

    • SHA256

      e50cf3f7139ac7f4924b835334a98f7c426b66d0d19e986d885bd4080433d7bd

    • SHA512

      bb2eee52e673c8e2ae44c60f0df8dc69890df2108f5278f1928f207055d5e8660fd8d8eaab9d67ee3ed950574184cbc94af77d831b601323afc31d715b9ec248

    Score
    10/10
    darkcometguest16persistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks