Overview

overview

10

Static

static

c68d0ea47c...ed.exe

windows7_x64

10

c68d0ea47c...ed.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c68d0ea47c9991b37b938c0d2635f2755668e185abcf937dc46b42758b600ded

  • Size

    520KB

  • Sample

    210922-qmvprafdbm

  • MD5

    8cacb0a780eab8956b0d068f51f720d2

  • SHA1

    f24f2b98db4bee8b0e5da51cb3d33ed6fd5c64c6

  • SHA256

    c68d0ea47c9991b37b938c0d2635f2755668e185abcf937dc46b42758b600ded

  • SHA512

    689e0c87bfff0698bf0fb88ee7129923ed619d6c1480d336f80e3de222e5f2f2ceb73ac3c50e456f7d8879e078868799cab7db30eafca89774c4bb0e0a5755b6

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      c68d0ea47c9991b37b938c0d2635f2755668e185abcf937dc46b42758b600ded

    • Size

      520KB

    • MD5

      8cacb0a780eab8956b0d068f51f720d2

    • SHA1

      f24f2b98db4bee8b0e5da51cb3d33ed6fd5c64c6

    • SHA256

      c68d0ea47c9991b37b938c0d2635f2755668e185abcf937dc46b42758b600ded

    • SHA512

      689e0c87bfff0698bf0fb88ee7129923ed619d6c1480d336f80e3de222e5f2f2ceb73ac3c50e456f7d8879e078868799cab7db30eafca89774c4bb0e0a5755b6

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks