Overview

overview

10

Static

static

cb96be84d7...f8.exe

windows7-x64

10

cb96be84d7...f8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8

  • Size

    738KB

  • Sample

    220731-x6wvgsecbm

  • MD5

    5eb58198721d4ded363e41e243e685cc

  • SHA1

    d3e349f052d215f392fbbdc657583d808fe51828

  • SHA256

    cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8

  • SHA512

    8fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6

Score
10/10
darkcometdelviepersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

delvie

C2

saw-88.no-ip.biz:1604

Mutex

DC_MUTEX-T3GAC5L

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    zSVFbDa27L2S

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8

    • Size

      738KB

    • MD5

      5eb58198721d4ded363e41e243e685cc

    • SHA1

      d3e349f052d215f392fbbdc657583d808fe51828

    • SHA256

      cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8

    • SHA512

      8fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6

    Score
    10/10
    darkcometdelviepersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks