Overview

overview

10

Static

static

10

ad4b63444e...66.exe

windows7-x64

10

ad4b63444e...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad4b63444e1ab0da9be8923f21494927dc9f6577c0fc268f9bc656fd497d2c66

  • Size

    1.1MB

  • Sample

    221126-pvh59adb23

  • MD5

    647c5dde7a82629ee388904031bfa96b

  • SHA1

    c73b8e712703e770d36b301fcf725fd0e6cb88f2

  • SHA256

    ad4b63444e1ab0da9be8923f21494927dc9f6577c0fc268f9bc656fd497d2c66

  • SHA512

    0bc9e989d3a27ef5ed2f1424fab902355c351ac40ecb613cb75a5d60ee295bcfdccd4840bf2f5eb2b15a53acd2cb5a6f37adb6d00e4e80e23268403243dfea5a

  • SSDEEP

    24576:QUKoN0bUxgGa/pfBHDb+y1LXPeCXuLKdsOT:TK1A6ze/KdX

Score
10/10
darkcometisrstealerevasionpersistenceratspywarestealertrojanupx

Malware Config

Targets

    • Target

      ad4b63444e1ab0da9be8923f21494927dc9f6577c0fc268f9bc656fd497d2c66

    • Size

      1.1MB

    • MD5

      647c5dde7a82629ee388904031bfa96b

    • SHA1

      c73b8e712703e770d36b301fcf725fd0e6cb88f2

    • SHA256

      ad4b63444e1ab0da9be8923f21494927dc9f6577c0fc268f9bc656fd497d2c66

    • SHA512

      0bc9e989d3a27ef5ed2f1424fab902355c351ac40ecb613cb75a5d60ee295bcfdccd4840bf2f5eb2b15a53acd2cb5a6f37adb6d00e4e80e23268403243dfea5a

    • SSDEEP

      24576:QUKoN0bUxgGa/pfBHDb+y1LXPeCXuLKdsOT:TK1A6ze/KdX

    Score
    10/10
    darkcometisrstealerevasionpersistenceratspywarestealertrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Modifies WinLogon for persistence

      persistence

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks