Overview

overview

10

Static

static

2c7ec6ddbf...f1.exe

windows7-x64

10

2c7ec6ddbf...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c7ec6ddbff93364c2f96227bc804da29826cfc10ff32b80b1d12a1acaf081f1

  • Size

    1.0MB

  • Sample

    221125-j12xnach27

  • MD5

    d7dbd0670862cfb5eaca24c091ce6cdd

  • SHA1

    754e3f28386a95391f8dc5f9eb51b176e23f4242

  • SHA256

    2c7ec6ddbff93364c2f96227bc804da29826cfc10ff32b80b1d12a1acaf081f1

  • SHA512

    1cbb39991c836f2bc9557f1f051b01df2b040db7f7c6541b3a8a687f994e361f90a7e7c7cd2d231b9ee986816d48cc4071568f0c2ee106a1c10ee434d8510e12

  • SSDEEP

    24576:O9poYtYhCNrGgKb6Z9pe7d+U0c/d4WwnB5UYh:O9p6xb09qdht/6zl

Score
10/10
darkcometguest16persistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

custumes.no-ip.biz:6712

Mutex

DC_MUTEX-4FXVAGJ

Attributes
  • gencode

    aRxiGL6irJ3D

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      2c7ec6ddbff93364c2f96227bc804da29826cfc10ff32b80b1d12a1acaf081f1

    • Size

      1.0MB

    • MD5

      d7dbd0670862cfb5eaca24c091ce6cdd

    • SHA1

      754e3f28386a95391f8dc5f9eb51b176e23f4242

    • SHA256

      2c7ec6ddbff93364c2f96227bc804da29826cfc10ff32b80b1d12a1acaf081f1

    • SHA512

      1cbb39991c836f2bc9557f1f051b01df2b040db7f7c6541b3a8a687f994e361f90a7e7c7cd2d231b9ee986816d48cc4071568f0c2ee106a1c10ee434d8510e12

    • SSDEEP

      24576:O9poYtYhCNrGgKb6Z9pe7d+U0c/d4WwnB5UYh:O9p6xb09qdht/6zl

    Score
    10/10
    darkcometguest16persistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks