Overview

overview

10

Static

static

91a04cda58...e4.exe

windows7-x64

10

91a04cda58...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91a04cda5888aa5c4e0e8cdd09d5576836d3714c39446a510ddb7f88ae372ae4

  • Size

    891KB

  • Sample

    220919-cms92acaf6

  • MD5

    ea271405c5d515469356a082f5a16dd6

  • SHA1

    bf2b2451d4d8e656067c81cf14362b9702ed7a57

  • SHA256

    91a04cda5888aa5c4e0e8cdd09d5576836d3714c39446a510ddb7f88ae372ae4

  • SHA512

    dc3c5ea202e4e311cbc35dc8d53b616bf657de01d91da9ce0e92ed39616424b3002035e41fe915791ba53f9b8822ea2c9100b22777ea0a4dac438be71a283440

  • SSDEEP

    24576:kKtgTB/3lPQZLh9h5qKUpEZl8fCjDS/2V0cs3:TAB/gLhw/ajDo2V0cK

Score
10/10
darkcometevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      91a04cda5888aa5c4e0e8cdd09d5576836d3714c39446a510ddb7f88ae372ae4

    • Size

      891KB

    • MD5

      ea271405c5d515469356a082f5a16dd6

    • SHA1

      bf2b2451d4d8e656067c81cf14362b9702ed7a57

    • SHA256

      91a04cda5888aa5c4e0e8cdd09d5576836d3714c39446a510ddb7f88ae372ae4

    • SHA512

      dc3c5ea202e4e311cbc35dc8d53b616bf657de01d91da9ce0e92ed39616424b3002035e41fe915791ba53f9b8822ea2c9100b22777ea0a4dac438be71a283440

    • SSDEEP

      24576:kKtgTB/3lPQZLh9h5qKUpEZl8fCjDS/2V0cs3:TAB/gLhw/ajDo2V0cK

    Score
    10/10
    darkcometevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks