Overview

overview

10

Static

static

965c44e42e...22.exe

windows7_x64

10

965c44e42e...22.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    965c44e42eed1cf973292171363735be199a1e914da22a402dc1c019b69dbd22

  • Size

    740KB

  • Sample

    210515-61ry7sjgk6

  • MD5

    7a03a13ed4082028a93e64d744cd6c31

  • SHA1

    d2c133f83b8e6907411f96008036cb5add897c37

  • SHA256

    965c44e42eed1cf973292171363735be199a1e914da22a402dc1c019b69dbd22

  • SHA512

    6f4c7e42cc4c23f0882a1d7090487d3430c64f89631a42a00c894fad1b56b7a0320f872c0b2e0048b2c2d41ecd569786ee66b497a97b780649345e1568fc61e0

Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Targets

    • Target

      965c44e42eed1cf973292171363735be199a1e914da22a402dc1c019b69dbd22

    • Size

      740KB

    • MD5

      7a03a13ed4082028a93e64d744cd6c31

    • SHA1

      d2c133f83b8e6907411f96008036cb5add897c37

    • SHA256

      965c44e42eed1cf973292171363735be199a1e914da22a402dc1c019b69dbd22

    • SHA512

      6f4c7e42cc4c23f0882a1d7090487d3430c64f89631a42a00c894fad1b56b7a0320f872c0b2e0048b2c2d41ecd569786ee66b497a97b780649345e1568fc61e0

    Score
    10/10
    darkcometevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks