Overview

overview

10

Static

static

8349770246...a6.exe

windows7-x64

10

8349770246...a6.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8349770246461d8d66380f0d4b1b48b166518d9ade3ae982c5f70d6c3ef5aba6

  • Size

    605KB

  • Sample

    221126-ckbbfaha71

  • MD5

    3f7cebe0e5fa1c7e9b4945267e26c3f6

  • SHA1

    486126993fd3090a14a979bd7fcc6025e149725a

  • SHA256

    8349770246461d8d66380f0d4b1b48b166518d9ade3ae982c5f70d6c3ef5aba6

  • SHA512

    d7e54ac48c2801f10659bc0d9a550d6cecaa2e1754a6432ba15bd5e4ac7fe89ee16800822696dbd640ff58b88971e6c9873790971d88f3567ef31a024d2f6c34

  • SSDEEP

    12288:D0nyfXuIBDtfuH0FkxcZEXPMwj08/v69ASJ1NGb55Yh/dWVPfWSBOBCikPkZnF:gny/f9uH0wcaXH08/u18YhsVPfuCikP4

Score
10/10
darkcomethackerevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Hacker

C2

leave1.no-ip.biz:1604

leave1.no-ip.biz:25565
Mutex

DC_MUTEX-SF1AS3Y

Attributes
  • InstallPath

    Adobe.exe

  • gencode

    v3wr0fYZFSSx

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    explorer

Targets

    • Target

      8349770246461d8d66380f0d4b1b48b166518d9ade3ae982c5f70d6c3ef5aba6

    • Size

      605KB

    • MD5

      3f7cebe0e5fa1c7e9b4945267e26c3f6

    • SHA1

      486126993fd3090a14a979bd7fcc6025e149725a

    • SHA256

      8349770246461d8d66380f0d4b1b48b166518d9ade3ae982c5f70d6c3ef5aba6

    • SHA512

      d7e54ac48c2801f10659bc0d9a550d6cecaa2e1754a6432ba15bd5e4ac7fe89ee16800822696dbd640ff58b88971e6c9873790971d88f3567ef31a024d2f6c34

    • SSDEEP

      12288:D0nyfXuIBDtfuH0FkxcZEXPMwj08/v69ASJ1NGb55Yh/dWVPfWSBOBCikPkZnF:gny/f9uH0wcaXH08/u18YhsVPfuCikP4

    Score
    10/10
    darkcomethackerevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks