Overview

overview

10

Static

static

10

2cfe915e14...0a.exe

windows7-x64

10

2cfe915e14...0a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a

  • Size

    5.5MB

  • Sample

    221125-2xnvqsga81

  • MD5

    564218aa29b51a220144e9d060d1252a

  • SHA1

    9168cca0beea91546fb15a7b936e66d1668015e1

  • SHA256

    2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a

  • SHA512

    2cd1418e7611b40c524a01d8e3ba6684c96b462690b0915c807ddb60b5d49090125e8fdc8c4bffc435d1add68d82d4094d48c74bd689f00e05d486cbfe6c03bc

  • SSDEEP

    98304:rwaQ8ZDJgyslyzoXmaErfYCNmkv5D2PFpuxvnkyyhAuax5O1RVidVSe8+QU/:rwaQ8ZDJw/WdftNnv5D29p0kyVuaO1Rn

Score
10/10
darkcometdanijelaevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Danijela

C2

jebozovan.no-ip.org:81

Mutex

DC_MUTEX-KQRQZPG

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    v7PAnw881ZWq

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a

    • Size

      5.5MB

    • MD5

      564218aa29b51a220144e9d060d1252a

    • SHA1

      9168cca0beea91546fb15a7b936e66d1668015e1

    • SHA256

      2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a

    • SHA512

      2cd1418e7611b40c524a01d8e3ba6684c96b462690b0915c807ddb60b5d49090125e8fdc8c4bffc435d1add68d82d4094d48c74bd689f00e05d486cbfe6c03bc

    • SSDEEP

      98304:rwaQ8ZDJgyslyzoXmaErfYCNmkv5D2PFpuxvnkyyhAuax5O1RVidVSe8+QU/:rwaQ8ZDJw/WdftNnv5D29p0kyVuaO1Rn

    Score
    10/10
    darkcometdanijelaevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks