Overview

overview

10

Static

static

d33390c154...bc.exe

windows7_x64

10

d33390c154...bc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d33390c1548497b6fad0f78111db2acf578ee41531336611c0b6cc6611a9cebc

  • Size

    521KB

  • Sample

    210908-k4gxbshdbr

  • MD5

    395fa99254a783e8592dcecdaa465140

  • SHA1

    587f1cc23c522eb2d0be6ab62a03bdd23df423a3

  • SHA256

    d33390c1548497b6fad0f78111db2acf578ee41531336611c0b6cc6611a9cebc

  • SHA512

    3095d3f673ffcaf69193189ebc159bccce4e0ed1a3d8188d5424ed0251bcf95ac3d7a9555e84dbcb52de37f234f568764737da2dab7f5ea56dbd9a553b95a235

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      d33390c1548497b6fad0f78111db2acf578ee41531336611c0b6cc6611a9cebc

    • Size

      521KB

    • MD5

      395fa99254a783e8592dcecdaa465140

    • SHA1

      587f1cc23c522eb2d0be6ab62a03bdd23df423a3

    • SHA256

      d33390c1548497b6fad0f78111db2acf578ee41531336611c0b6cc6611a9cebc

    • SHA512

      3095d3f673ffcaf69193189ebc159bccce4e0ed1a3d8188d5424ed0251bcf95ac3d7a9555e84dbcb52de37f234f568764737da2dab7f5ea56dbd9a553b95a235

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks