General

  • Target

    2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b

  • Size

    674KB

  • Sample

    221011-k9p5wsfgb6

  • MD5

    6b0a485a1d738b5e8f8b5cc6f89f9770

  • SHA1

    cbbb17136c1d24a5a4891825a9e381e0df84142d

  • SHA256

    2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b

  • SHA512

    0315b3849fe665795ca2784e3cd3bd43a61f7aa6ab216fdad076b8a2f92e966a10786ace416f5a368c5586041c14792c062a4a64f608ef48e48f8beb3c5f27e0

  • SSDEEP

    12288:w9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hb:UZ1xuVVjfFoynPaVBUR8f+kN10EBV

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

scan247.noip.me:1984

Mutex

DC_MUTEX-4RAP6WL

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    YbQjH7ZVU9Cr

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b

    • Size

      674KB

    • MD5

      6b0a485a1d738b5e8f8b5cc6f89f9770

    • SHA1

      cbbb17136c1d24a5a4891825a9e381e0df84142d

    • SHA256

      2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b

    • SHA512

      0315b3849fe665795ca2784e3cd3bd43a61f7aa6ab216fdad076b8a2f92e966a10786ace416f5a368c5586041c14792c062a4a64f608ef48e48f8beb3c5f27e0

    • SSDEEP

      12288:w9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hb:UZ1xuVVjfFoynPaVBUR8f+kN10EBV

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks