Overview

overview

10

Static

static

10

DARKCOMET ...ty.exe

windows7_x64

1

DARKCOMET ...ty.exe

windows10-2004_x64

1

DARKCOMET ...ed.exe

windows7_x64

10

DARKCOMET ...ed.exe

windows10-2004_x64

10

DARKCOMET ...er.exe

windows7_x64

1

DARKCOMET ...er.exe

windows10-2004_x64

1

DARKCOMET ...e3.dll

windows7_x64

3

DARKCOMET ...e3.dll

windows10-2004_x64

3

DARKCOMET ...er.dll

windows7_x64

1

DARKCOMET ...er.dll

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DARKCOMET 5.3.1 Fixed.rar

  • Size

    14.1MB

  • Sample

    220710-1hmhpadbbp

  • MD5

    a1399dccd944dfa655e58f5dc0ff5920

  • SHA1

    36f53ad1537dbe1ac8d7f5e5e316882a0da075f5

  • SHA256

    fcbb43c0be279fcf50235b26953e1d53b896a72d17c9c34796918da00acda156

  • SHA512

    400aba2b4d316f8a415b9d1ab276b919f85b8c43bb16990032b2ef0e0ff23c7b48516899d83666fe291d90dd235a5af0fe67073fcf465d105759f51fd85b9ee8

Score
10/10
asyncratdarkcometdefaultguest16evasionpersistenceratsuricatatrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Java Update.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

sussysdfffdfff343.duckdns.org:1604

Mutex

DC_MUTEX-DPR96FP

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    UxV043A3qL1c

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Celesty Binder/Celesty.exe

    • Size

      2.7MB

    • MD5

      c3009ee63bc661d9ea75eaeb256448ca

    • SHA1

      45eb01150756df432e25eed44d976442473356de

    • SHA256

      0bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352

    • SHA512

      96f5847fbeef95df1309e97a4bc3d786a5f5c19b87e804f12d88b4473a0b50291c40407a3d95a2d5d78031f03be76da47f1846a73c7802ddae46a38ac4634e67

    Score
    1/10
    behavioral1behavioral2

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/DarkComet_RAT Fixed.exe

    • Size

      12.1MB

    • MD5

      4e34e517da6dd7bbcc71474373aaabb5

    • SHA1

      760302b5393a48989b5e589a7698f2d421185d0b

    • SHA256

      b08610470110041f9b1110cb64ba3d533336cdb32e97283710fcfdaea03bf9d1

    • SHA512

      de9f8231625a8546f23fd572e31db5ec4ea4e458987f0c4d857952ce35ada1643f051cdc86f8728cd6b900937783bff98736edc8e94d3ad7ea5d749a6a53b863

    Score
    10/10
    asyncratdarkcometdefaultguest16evasionpersistenceratsuricatatrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • suricata: ET MALWARE Backdoor.Win32.DarkComet Screenshot Upload Successful

      suricata: ET MALWARE Backdoor.Win32.DarkComet Screenshot Upload Successful

      suricata

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Spoof extensions/Spoofer.exe

    • Size

      2.0MB

    • MD5

      894b256f41dc579a5b32828ed2f7e3db

    • SHA1

      06fa1a4dd30780e404c8f2e7a615fd54d6f2ae68

    • SHA256

      12dbd354b4cc073ea7f80cc0d74bd96118362e9c120df7800cf0f9e863569f98

    • SHA512

      bede5a2c6e87ac6d432903109cca97fcbf60fdba082ba137a04c6ca6490a548f20910b6560821816b76744235fa19f5fcbe256c1ad9b87c2c1b8b20e5c5ac409

    Score
    1/10
    behavioral5behavioral6

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/sqlite3.dll

    • Size

      510KB

    • MD5

      d3979db259f55d59b4edb327673c1905

    • SHA1

      0697e8f35b5951c61a3a632d74fd96843c941628

    • SHA256

      043e5570299c6099756c1809c5632eabeab95ed3c1a55c86843c0ec218940e5a

    • SHA512

      0b87c89aafd3e627c7d6bed0b833601fea1917a76a972061f32a2d9e4aa2e9e85b5e8a67cb330ca44aff17915d0fe2793798451a109d3f0b5014eed06b73bb45

    Score
    3/10
    behavioral7behavioral8

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/userfixer.dll

    • Size

      2.2MB

    • MD5

      81598070e630b776a8f6953dd8206915

    • SHA1

      1e14345e73476c7b1b85cb30d904730b50f8b2c4

    • SHA256

      d169c3502a9e8ada5a994bcf06d3a1ba57142b0a47b4424d364305e64151e1c9

    • SHA512

      e1d7d3074f7e525053789518a0e685d722dbbcf5df67364cb3954a8a29af22cb09990343ed41772894ce174534abef71237a9ea5006dbd2e6e4c78ee7b5ebe22

    Score
    1/10
    behavioral9behavioral10

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

2
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks