Overview

overview

10

Static

static

75cfd0a0c8...c7.exe

windows7-x64

10

75cfd0a0c8...c7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75cfd0a0c8b9bc3f741e0963ab00d5c7.exe

  • Size

    1.4MB

  • Sample

    220831-sgqjyshfg2

  • MD5

    75cfd0a0c8b9bc3f741e0963ab00d5c7

  • SHA1

    495477cdbadf5c7ba26c7e8e2903ce6534b15e32

  • SHA256

    daf01c5114ac5dd2e6a52d4ce4174e19482ed9f4d0409d734bc3c39a29f48497

  • SHA512

    3d41c848394f5dfe1c6a2bbd31e13d221938a3d5c5e0091609348f15b0d3b293329c00ff32da02ee8d8bc3d3f5483266dfccfa5e6e6523f6e0261ff9ac3f7ebb

  • SSDEEP

    24576:TAwLuc7VRctRRm/vqQIbwGiYEX3PuOobtnLtd/uo34qFlLBxC:MwLuestsvrCAWlbtLtNu8n

Score
10/10
darkcometlokibotguest16collectionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

185.140.53.117:1985

Mutex

DC_MUTEX-QFGHKXR

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    hW0MZpETNScR

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Extracted

Family

lokibot

C2

http://login-mail-server.s3rv.me/server/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      75cfd0a0c8b9bc3f741e0963ab00d5c7.exe

    • Size

      1.4MB

    • MD5

      75cfd0a0c8b9bc3f741e0963ab00d5c7

    • SHA1

      495477cdbadf5c7ba26c7e8e2903ce6534b15e32

    • SHA256

      daf01c5114ac5dd2e6a52d4ce4174e19482ed9f4d0409d734bc3c39a29f48497

    • SHA512

      3d41c848394f5dfe1c6a2bbd31e13d221938a3d5c5e0091609348f15b0d3b293329c00ff32da02ee8d8bc3d3f5483266dfccfa5e6e6523f6e0261ff9ac3f7ebb

    • SSDEEP

      24576:TAwLuc7VRctRRm/vqQIbwGiYEX3PuOobtnLtd/uo34qFlLBxC:MwLuestsvrCAWlbtLtNu8n

    Score
    10/10
    darkcometlokibotguest16persistenceratspywarestealertrojancollection

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks