Overview

overview

10

Static

static

5593d25697...11.exe

windows7-x64

10

5593d25697...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11

  • Size

    1.1MB

  • Sample

    221124-cnxc3sba38

  • MD5

    a69d7489bf86c0bcc6bf5b8a084ae781

  • SHA1

    89bd2b4f2aa013c7babcaf0fa35991cefd81b8da

  • SHA256

    5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11

  • SHA512

    937532d1018aa37e5c512067b3a52ddf3c6ff6f3f6ec883866e3a32b1615d9cbbc34483107d5db17f441454d15fcd9f4aa2ac4c17b3cfc58eecd2a9d6b8efb8b

  • SSDEEP

    12288:YNazwlQZGxtBB5rnYOvhzmT9venv4Fiq271BQ6qG/31kfVvU+42j8j9:YNqMQZI6Ove4nBBj1QP4g49

Score
10/10
darkcometnewest11persistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Newest11

C2

numberoneminecraft.serveminecraft.net:9001

Mutex

DC_MUTEX-NU7E6HS

Attributes
  • gencode

    tlNkFNx3gjhk

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

Targets

    • Target

      5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11

    • Size

      1.1MB

    • MD5

      a69d7489bf86c0bcc6bf5b8a084ae781

    • SHA1

      89bd2b4f2aa013c7babcaf0fa35991cefd81b8da

    • SHA256

      5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11

    • SHA512

      937532d1018aa37e5c512067b3a52ddf3c6ff6f3f6ec883866e3a32b1615d9cbbc34483107d5db17f441454d15fcd9f4aa2ac4c17b3cfc58eecd2a9d6b8efb8b

    • SSDEEP

      12288:YNazwlQZGxtBB5rnYOvhzmT9venv4Fiq271BQ6qG/31kfVvU+42j8j9:YNqMQZI6Ove4nBBj1QP4g49

    Score
    10/10
    darkcometnewest11persistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks