Overview

overview

10

Static

static

dde7e1a84d...f0.exe

windows7_x64

10

dde7e1a84d...f0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dde7e1a84de71961c7c2f8de086887e95403b9db00ac15be432b8c0ea6e600f0

  • Size

    1.6MB

  • Sample

    220203-sfx8eaahgj

  • MD5

    1b6bd8b3d870fb9ef9565dd703455919

  • SHA1

    2f36132ffc95082bda75c43e53290c4a74565095

  • SHA256

    dde7e1a84de71961c7c2f8de086887e95403b9db00ac15be432b8c0ea6e600f0

  • SHA512

    47f95a7b6b542b660c7bffe29c6e87a1d0115ba288175191afdaf14a57a5dbfafbd31ad0698f35480539593362c1b0dfd6558d669361f9f0353445591ff3ef68

Score
10/10
darkcometrandompersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Random

C2

t3chie.no-ip.biz:1604

Mutex

DC_MUTEX-FLCLE41

Attributes
  • gencode

    FfYLXAQDzp0t

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      dde7e1a84de71961c7c2f8de086887e95403b9db00ac15be432b8c0ea6e600f0

    • Size

      1.6MB

    • MD5

      1b6bd8b3d870fb9ef9565dd703455919

    • SHA1

      2f36132ffc95082bda75c43e53290c4a74565095

    • SHA256

      dde7e1a84de71961c7c2f8de086887e95403b9db00ac15be432b8c0ea6e600f0

    • SHA512

      47f95a7b6b542b660c7bffe29c6e87a1d0115ba288175191afdaf14a57a5dbfafbd31ad0698f35480539593362c1b0dfd6558d669361f9f0353445591ff3ef68

    Score
    10/10
    darkcometrandomrattrojanupxpersistence

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks