Overview

overview

10

Static

static

10

0fc3af1121...04.exe

windows7-x64

10

0fc3af1121...04.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04

  • Size

    477KB

  • Sample

    221003-trtvssedg4

  • MD5

    34e4111287c0af6b8c72167016a1f9f0

  • SHA1

    61b9719f5efd4fc88daee199b0adf8fd454058a3

  • SHA256

    0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04

  • SHA512

    56fc07a2db806b4907ed8bc2ad645c44b98722f0ce5c0eb14672acf8840475bb82253b6fbc9cae3c88f51e6e95469356d5423a3ab6a1ad729e9477ba974dc747

  • SSDEEP

    12288:XwkHcpSHY7VSrfT2/czO3Hx+p7aPZcByrH1Ia2aRTiua:Xh8uYxSrDzwRmAZcB+H1Y

Score
10/10
darkcometevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04

    • Size

      477KB

    • MD5

      34e4111287c0af6b8c72167016a1f9f0

    • SHA1

      61b9719f5efd4fc88daee199b0adf8fd454058a3

    • SHA256

      0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04

    • SHA512

      56fc07a2db806b4907ed8bc2ad645c44b98722f0ce5c0eb14672acf8840475bb82253b6fbc9cae3c88f51e6e95469356d5423a3ab6a1ad729e9477ba974dc747

    • SSDEEP

      12288:XwkHcpSHY7VSrfT2/czO3Hx+p7aPZcByrH1Ia2aRTiua:Xh8uYxSrDzwRmAZcB+H1Y

    Score
    10/10
    darkcometevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks