Overview

overview

10

Static

static

2702fe34d5...a2.exe

windows7-x64

10

2702fe34d5...a2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2

  • Size

    452KB

  • Sample

    221123-r4nhfadc8y

  • MD5

    7de9787876d0ecb71648f25bd1e5fc51

  • SHA1

    2bc2b1a2977b64eb22d069941a45abfe04d44622

  • SHA256

    2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2

  • SHA512

    347a214a9cfbbd799e1a0f11568959884909d9dbd9bafd8302859af9ab7c5a2bb5328a1f28260b1839f1dd6952197e02bd75cd5a09dec4026181857d8b2b4bc9

  • SSDEEP

    12288:6M5tnmfeuL8U3yoWwYLtfCgaNiAY8lIkd+:6M5p2nL8A8wYLgFNfj

Score
10/10
darkcometsureteypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

suretey

C2

kaspanet.jed-group.com:1660

Mutex

DC_MUTEX-DW9F7R5

Attributes
  • gencode

    gagSQD1wwynQ

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2

    • Size

      452KB

    • MD5

      7de9787876d0ecb71648f25bd1e5fc51

    • SHA1

      2bc2b1a2977b64eb22d069941a45abfe04d44622

    • SHA256

      2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2

    • SHA512

      347a214a9cfbbd799e1a0f11568959884909d9dbd9bafd8302859af9ab7c5a2bb5328a1f28260b1839f1dd6952197e02bd75cd5a09dec4026181857d8b2b4bc9

    • SSDEEP

      12288:6M5tnmfeuL8U3yoWwYLtfCgaNiAY8lIkd+:6M5p2nL8A8wYLgFNfj

    Score
    10/10
    darkcometsureteypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks