Overview

overview

10

Static

static

10

5ca683cbdb...51.exe

windows7-x64

10

5ca683cbdb...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ca683cbdb5337f5c94c7bfe962fc90d53925a9f4b1b5af7fddafbbc533fad51

  • Size

    741KB

  • Sample

    221128-f99r3sdh51

  • MD5

    a7f56fcdfa95038b8f762f09ad511afe

  • SHA1

    c6ec11b8b3785927d790db052315c982a1c33ad5

  • SHA256

    5ca683cbdb5337f5c94c7bfe962fc90d53925a9f4b1b5af7fddafbbc533fad51

  • SHA512

    2943018648bdd7330104a54c52c6ad45e096177811d2db7093ca79135c2bdb479b08e359c14b3b4ab18a42ef506e830cc528a6dfd8851153a9753565bb1c1d71

  • SSDEEP

    12288:b4b9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h8aCa:bIZ1xuVVjfFoynPaVBUR8f+kN10EBaar

Score
10/10
darkcometkillingtimesevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

killingtimes

C2

killingtimes.zapto.org:1604

Mutex

DC_MUTEX-5C0Q2SX

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    a12RUSVje4vW

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      5ca683cbdb5337f5c94c7bfe962fc90d53925a9f4b1b5af7fddafbbc533fad51

    • Size

      741KB

    • MD5

      a7f56fcdfa95038b8f762f09ad511afe

    • SHA1

      c6ec11b8b3785927d790db052315c982a1c33ad5

    • SHA256

      5ca683cbdb5337f5c94c7bfe962fc90d53925a9f4b1b5af7fddafbbc533fad51

    • SHA512

      2943018648bdd7330104a54c52c6ad45e096177811d2db7093ca79135c2bdb479b08e359c14b3b4ab18a42ef506e830cc528a6dfd8851153a9753565bb1c1d71

    • SSDEEP

      12288:b4b9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h8aCa:bIZ1xuVVjfFoynPaVBUR8f+kN10EBaar

    Score
    10/10
    darkcometkillingtimesevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks