Overview

overview

10

Static

static

10

bcd46cd761...04.exe

windows7-x64

10

bcd46cd761...04.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bcd46cd761c8b2642bf2949b27eabd7137ab87bcec31668b38e232f3062d7304

  • Size

    874KB

  • Sample

    221126-cgl9jagh3z

  • MD5

    f78322eb1a7178d96d5e5078080cec66

  • SHA1

    047a97bcaeb4021d2ed6e15bf035216a3ea26b0a

  • SHA256

    bcd46cd761c8b2642bf2949b27eabd7137ab87bcec31668b38e232f3062d7304

  • SHA512

    7ba354300080d4d6792d6a1bf40d4a434be6e51283a72cb1287695b747b78d33dad6364a81a353e4cf5c2e5c80ec429d7b012c64ef75f48216850551e89b31aa

  • SSDEEP

    24576:5Z1xuVVjfFoynPaVBUR8f+kN10EB2RGVQaS:jQDgok309SQaS

Score
10/10
darkcometzombieevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

ZOMBIE

C2

hdycusje62bh5.no-ip.biz:666

Mutex

DC_MUTEX-V6VMQ0J

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    rsW07CoVpt23

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      bcd46cd761c8b2642bf2949b27eabd7137ab87bcec31668b38e232f3062d7304

    • Size

      874KB

    • MD5

      f78322eb1a7178d96d5e5078080cec66

    • SHA1

      047a97bcaeb4021d2ed6e15bf035216a3ea26b0a

    • SHA256

      bcd46cd761c8b2642bf2949b27eabd7137ab87bcec31668b38e232f3062d7304

    • SHA512

      7ba354300080d4d6792d6a1bf40d4a434be6e51283a72cb1287695b747b78d33dad6364a81a353e4cf5c2e5c80ec429d7b012c64ef75f48216850551e89b31aa

    • SSDEEP

      24576:5Z1xuVVjfFoynPaVBUR8f+kN10EB2RGVQaS:jQDgok309SQaS

    Score
    10/10
    darkcometzombieevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

2
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

7
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks