Overview

overview

10

Static

static

10

1c12a0944f...d9.exe

windows7-x64

10

1c12a0944f...d9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1c12a0944f8c5ff390414f3819231dc1c5da9a42b37e1101629cbd8a8aed4cd9

  • Size

    660KB

  • Sample

    221107-thaqkahbdp

  • MD5

    0e1968b23c861d593e46fdb470304352

  • SHA1

    1a88de91fb267c47a4276d669a2560e427dcb52f

  • SHA256

    1c12a0944f8c5ff390414f3819231dc1c5da9a42b37e1101629cbd8a8aed4cd9

  • SHA512

    dc70e467c80f150be00dabf3c1202e4fc1dba6d21ff7e4d400ddadcfb47d3ffc99f342163b00e7d937ced6f23c329fdb0d9504293c3125bc06febcaa2045afd7

  • SSDEEP

    12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U+:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Ju

Score
10/10
darkcometguest16_minpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

192.168.178.35:1604

Mutex

DCMIN_MUTEX-G4MQZX2

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    ne0Phxx05u4F

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Targets

    • Target

      1c12a0944f8c5ff390414f3819231dc1c5da9a42b37e1101629cbd8a8aed4cd9

    • Size

      660KB

    • MD5

      0e1968b23c861d593e46fdb470304352

    • SHA1

      1a88de91fb267c47a4276d669a2560e427dcb52f

    • SHA256

      1c12a0944f8c5ff390414f3819231dc1c5da9a42b37e1101629cbd8a8aed4cd9

    • SHA512

      dc70e467c80f150be00dabf3c1202e4fc1dba6d21ff7e4d400ddadcfb47d3ffc99f342163b00e7d937ced6f23c329fdb0d9504293c3125bc06febcaa2045afd7

    • SSDEEP

      12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U+:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Ju

    Score
    10/10
    darkcometguest16_minpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks