Overview

overview

10

Static

static

28711e96e7...f5.exe

windows7-x64

10

28711e96e7...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5

  • Size

    900KB

  • Sample

    221125-d56hrace91

  • MD5

    dc9d7b6a5110abb328bf595d056ce40d

  • SHA1

    efab84b08c63cfe9fb703462a24a9961daa05b08

  • SHA256

    28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5

  • SHA512

    053179b603c513c7be82a355c9b7f0b7bf5edf4ccf083f533d8bf7a9da19dfe558c7ff08d3f7d61c4db28a2f2d72a1af5ce40cb580662ce1440bf97e35f7a16f

  • SSDEEP

    12288:k0l9Cga3LAdaU+zV44yzQ9Jf/opEpZI5yRXyoQZDhQruxXV/9rPTzgbLgXy+Vo0K:j4iUCaLRpFX2WuxXVtPTEgC+60K

Score
10/10
darkcometsummerpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

summer

C2

qsab98.no-ip.biz:1604

Mutex

DC_MUTEX-6G9L12L

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    6QgnJweVD4dH

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5

    • Size

      900KB

    • MD5

      dc9d7b6a5110abb328bf595d056ce40d

    • SHA1

      efab84b08c63cfe9fb703462a24a9961daa05b08

    • SHA256

      28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5

    • SHA512

      053179b603c513c7be82a355c9b7f0b7bf5edf4ccf083f533d8bf7a9da19dfe558c7ff08d3f7d61c4db28a2f2d72a1af5ce40cb580662ce1440bf97e35f7a16f

    • SSDEEP

      12288:k0l9Cga3LAdaU+zV44yzQ9Jf/opEpZI5yRXyoQZDhQruxXV/9rPTzgbLgXy+Vo0K:j4iUCaLRpFX2WuxXVtPTEgC+60K

    Score
    10/10
    darkcometsummerpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks