Overview

overview

10

Static

static

4b639b70d9...f7.exe

windows7_x64

10

4b639b70d9...f7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b639b70d9414e1f754fab20ca28e785aeede026403949d997378d42dcb0fff7

  • Size

    550KB

  • Sample

    220712-l5tsysdddj

  • MD5

    bd6c3dfba3e67ea50e34fdcb449d0be6

  • SHA1

    70d65fc8b984a2312ae19be499ae38de320f94b1

  • SHA256

    4b639b70d9414e1f754fab20ca28e785aeede026403949d997378d42dcb0fff7

  • SHA512

    db6489c768ca9aaf1d0eef45699f6f37b6616450b4496c82ae0de1c6a01111ea91e59e293c824d1cd0076341fce884729f4a1bbf84d82fdfe367be7f1d8a3f06

Score
10/10
darkcometqlqpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

qlq

C2

127.0.0.1:1604

alrdmh1.no-ip.info:1604
Mutex

DC_MUTEX-SW2Y3F8

Attributes
  • InstallPath

    MSDCSC\ssms.exe

  • gencode

    pqNMGaVpt3ZJ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      4b639b70d9414e1f754fab20ca28e785aeede026403949d997378d42dcb0fff7

    • Size

      550KB

    • MD5

      bd6c3dfba3e67ea50e34fdcb449d0be6

    • SHA1

      70d65fc8b984a2312ae19be499ae38de320f94b1

    • SHA256

      4b639b70d9414e1f754fab20ca28e785aeede026403949d997378d42dcb0fff7

    • SHA512

      db6489c768ca9aaf1d0eef45699f6f37b6616450b4496c82ae0de1c6a01111ea91e59e293c824d1cd0076341fce884729f4a1bbf84d82fdfe367be7f1d8a3f06

    Score
    10/10
    darkcometqlqpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks