Overview

overview

10

Static

static

10

e2122ee5ee...73.exe

windows7-x64

10

e2122ee5ee...73.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2122ee5ee266ca649e633a271af82d1acc35c3184e09e8b8977c83b4fd90a73

  • Size

    948KB

  • Sample

    221030-r4krjsfgbq

  • MD5

    92cdbd46a7ad2ef757714a8161a8e440

  • SHA1

    28b912711321390217218795d4a644e0e8c2d307

  • SHA256

    e2122ee5ee266ca649e633a271af82d1acc35c3184e09e8b8977c83b4fd90a73

  • SHA512

    cf43115671c766409ad4f638ac3979727389ebfb3be2d8a24b939bf50e65f5f5f13c836bf3a1fdc8f5577a79116acf2238f921720fb093caba611c7ae25ffc97

  • SSDEEP

    24576:SZ1xuVVjfFoynPaVBUR8f+kN10EBZsIyjq:SQDgok30CCq

Score
10/10
darkcomethfevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

HF

C2

jackszeug.no-ip.org:1604

Mutex

DC_MUTEX-CADZCKB

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    ikTYUmR4HGT2

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      e2122ee5ee266ca649e633a271af82d1acc35c3184e09e8b8977c83b4fd90a73

    • Size

      948KB

    • MD5

      92cdbd46a7ad2ef757714a8161a8e440

    • SHA1

      28b912711321390217218795d4a644e0e8c2d307

    • SHA256

      e2122ee5ee266ca649e633a271af82d1acc35c3184e09e8b8977c83b4fd90a73

    • SHA512

      cf43115671c766409ad4f638ac3979727389ebfb3be2d8a24b939bf50e65f5f5f13c836bf3a1fdc8f5577a79116acf2238f921720fb093caba611c7ae25ffc97

    • SSDEEP

      24576:SZ1xuVVjfFoynPaVBUR8f+kN10EBZsIyjq:SQDgok30CCq

    Score
    10/10
    darkcomethfevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks