Overview

overview

10

Static

static

3ada9c8c85...8d.exe

windows7-x64

10

3ada9c8c85...8d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ada9c8c85d1e4190e23e991b67fd4a7b742ad53e8619c17de95e7bf9fdcdd8d

  • Size

    2.7MB

  • Sample

    221128-p84dcaec46

  • MD5

    95b7d69d2ca4edd407c417c3cc1ba1fb

  • SHA1

    da6f9a7028528c496ef3531120d5529889820efa

  • SHA256

    3ada9c8c85d1e4190e23e991b67fd4a7b742ad53e8619c17de95e7bf9fdcdd8d

  • SHA512

    975c166f60256a47da33373e70036c41e811e9ac23004e151cd72f5ca303ccf996d7dc6b908bc84d717228be3869af6f4af9dbbf8d076ed37520bfa864030211

  • SSDEEP

    3072:MUCGG2BGieQ6Bp0+6clEyu6ZrJE5ORErW4CwrEEGEJxt05mtj9GrvSqgXiJOjvtZ:MUCR2BGNg+6L1

Score
10/10
darkcometinfectedevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Infected

C2

cristudios.ddns.net:2604

Mutex

DC_MUTEX-8K7GCQR

Attributes
  • InstallPath

    SecurityUpdate\winsecurity.exe

  • gencode

    EQfox0SM0ZJ0

  • install

    true

  • offline_keylogger

    true

  • password

    231814010

  • persistence

    true

  • reg_key

    SecurityUpdate

Targets

    • Target

      3ada9c8c85d1e4190e23e991b67fd4a7b742ad53e8619c17de95e7bf9fdcdd8d

    • Size

      2.7MB

    • MD5

      95b7d69d2ca4edd407c417c3cc1ba1fb

    • SHA1

      da6f9a7028528c496ef3531120d5529889820efa

    • SHA256

      3ada9c8c85d1e4190e23e991b67fd4a7b742ad53e8619c17de95e7bf9fdcdd8d

    • SHA512

      975c166f60256a47da33373e70036c41e811e9ac23004e151cd72f5ca303ccf996d7dc6b908bc84d717228be3869af6f4af9dbbf8d076ed37520bfa864030211

    • SSDEEP

      3072:MUCGG2BGieQ6Bp0+6clEyu6ZrJE5ORErW4CwrEEGEJxt05mtj9GrvSqgXiJOjvtZ:MUCR2BGNg+6L1

    Score
    10/10
    darkcometinfectedevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks