Overview

overview

10

Static

static

3ddb383a5a...58.exe

windows7-x64

10

3ddb383a5a...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58

  • Size

    546KB

  • Sample

    221003-cqyc6abhh6

  • MD5

    3ed968b2400a5eca52fcf8dc1422ece0

  • SHA1

    10cc685424f274c7b42d26cacf7ad2319fe56000

  • SHA256

    3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58

  • SHA512

    e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d

  • SSDEEP

    6144:yJanGOkb7CaMWBe/IMr0yRu7ZcUBpofb71/cJlClb:y+G2WBqxgN7ZcUBGfb5/cJlCh

Score
10/10
darkcometguest16persistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

nonalova.no-ip.org:82

Mutex

DC_MUTEX-Q0QWMJU

Attributes
  • InstallPath

    adobe\adobeARM.exe

  • gencode

    GNFv06aHFX6N

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    adobeARM

Targets

    • Target

      3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58

    • Size

      546KB

    • MD5

      3ed968b2400a5eca52fcf8dc1422ece0

    • SHA1

      10cc685424f274c7b42d26cacf7ad2319fe56000

    • SHA256

      3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58

    • SHA512

      e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d

    • SSDEEP

      6144:yJanGOkb7CaMWBe/IMr0yRu7ZcUBpofb71/cJlClb:y+G2WBqxgN7ZcUBGfb5/cJlCh

    Score
    10/10
    darkcometguest16persistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks