Overview

overview

10

Static

static

89d15a3ee4...10.exe

windows7_x64

10

89d15a3ee4...10.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710

  • Size

    235KB

  • Sample

    220520-3ht9msghf9

  • MD5

    c59db4ec885ca9531c44c6a2efc30d6b

  • SHA1

    ba38b0c7a46992d2ae0540a9bc2e89dacd31b834

  • SHA256

    89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710

  • SHA512

    9ca82da3e8ec092b0beec4ff5be0d21c7046f0c6a8e24ea3524258242fd9f2e0db4988b1ee742d1428aca29b3e94812829bc1f7530d8ad9b72a84aa6a38800a4

Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Targets

    • Target

      89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710

    • Size

      235KB

    • MD5

      c59db4ec885ca9531c44c6a2efc30d6b

    • SHA1

      ba38b0c7a46992d2ae0540a9bc2e89dacd31b834

    • SHA256

      89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710

    • SHA512

      9ca82da3e8ec092b0beec4ff5be0d21c7046f0c6a8e24ea3524258242fd9f2e0db4988b1ee742d1428aca29b3e94812829bc1f7530d8ad9b72a84aa6a38800a4

    Score
    10/10
    darkcometevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks