Overview

overview

10

Static

static

59ca328456...30.exe

windows7-x64

10

59ca328456...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59ca328456e4b599732fc4e01a03979a1275c509ccb976758946366e84cb5b30

  • Size

    785KB

  • Sample

    221125-lbfn8sfg67

  • MD5

    4695d2497f5b72d147ad34dc7b54140d

  • SHA1

    b46f3852b6a164d7de2f2e2a7a536470c4f344ae

  • SHA256

    59ca328456e4b599732fc4e01a03979a1275c509ccb976758946366e84cb5b30

  • SHA512

    9daf6e0726d232f3173a9b0ed3f28fccb3310e1e69c132ba5a611db420b15250fe622951ec773819442bbe8a6e17d422f3a9256ce4148d60b1966ae37e3280bd

  • SSDEEP

    12288:te/4ed1gLqODJXXn3n0kZJk+vZi3G0khHCpp1tlAhpxz:4/nsqOJXnkk/k2wW064dlY

Score
10/10
darkcometspypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Spy

C2

127.0.0.1:1604

nibiru3.duckdns.org:1604

nibiru33.duckdns.org:1604
Mutex

DC_MUTEX-QE733CL

Attributes
  • InstallPath

    MSDCSC\Audio Realtek Driver.exe

  • gencode

    R3iDnMXzRFHM

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Audio Realtek Driver

Targets

    • Target

      59ca328456e4b599732fc4e01a03979a1275c509ccb976758946366e84cb5b30

    • Size

      785KB

    • MD5

      4695d2497f5b72d147ad34dc7b54140d

    • SHA1

      b46f3852b6a164d7de2f2e2a7a536470c4f344ae

    • SHA256

      59ca328456e4b599732fc4e01a03979a1275c509ccb976758946366e84cb5b30

    • SHA512

      9daf6e0726d232f3173a9b0ed3f28fccb3310e1e69c132ba5a611db420b15250fe622951ec773819442bbe8a6e17d422f3a9256ce4148d60b1966ae37e3280bd

    • SSDEEP

      12288:te/4ed1gLqODJXXn3n0kZJk+vZi3G0khHCpp1tlAhpxz:4/nsqOJXnkk/k2wW064dlY

    Score
    10/10
    darkcometspypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks