Overview

overview

10

Static

static

8

46b620f55c...40.exe

windows7_x64

10

46b620f55c...40.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940

  • Size

    308KB

  • Sample

    220707-jswexafgbq

  • MD5

    a7495ebd5b117c20f373a1769534470a

  • SHA1

    2fa33f0113d280d0aaa73e94e79a4c02fa78e788

  • SHA256

    46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940

  • SHA512

    363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9

Score
10/10
darkcometramnitguest16bankerevasionpersistenceratspywarestealertrojanupxworm

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

bibl12345.ddns.net:1604

Mutex

DC_MUTEX-AJ56C7W

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Jy8jYvuQiUbf

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Windows

Targets

    • Target

      46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940

    • Size

      308KB

    • MD5

      a7495ebd5b117c20f373a1769534470a

    • SHA1

      2fa33f0113d280d0aaa73e94e79a4c02fa78e788

    • SHA256

      46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940

    • SHA512

      363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9

    Score
    10/10
    darkcometramnitguest16bankerevasionpersistenceratspywarestealertrojanupxworm

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

2
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

8
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks