Overview

overview

10

Static

static

10

f5b73449c2...06.exe

windows7-x64

10

f5b73449c2...06.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5b73449c2676a77e450daf2b857b7ce7e6d71f1df413c71121a8fe75611e106

  • Size

    2.0MB

  • Sample

    221130-3pkc1sae5w

  • MD5

    106ef53fb7ce9154d94f9bdc2c500bc9

  • SHA1

    a40d67c5f8fa2a942bde71a545e9e992f13da6b8

  • SHA256

    f5b73449c2676a77e450daf2b857b7ce7e6d71f1df413c71121a8fe75611e106

  • SHA512

    b6784bff0fde2276a5dab1f2b562760f665e94c60380f9a2b2739b29f1897aebe86e31a2c3b7d343906b296d8a698c32c2593848e2f2ab77257f46b9a5f35201

  • SSDEEP

    49152:Xoeqhqi7TSiZHIeakF61r4jfyfAX2tNs6F2jF5KoH/8x:Xa/n/ZCkYVgQAS66F2jF1

Score
10/10
darkcometmodiloaderêôýíñ ìïíïevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

ÊÔÝíÑ ÌÏíÏ

C2

modyy.no-ip.info:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    xGNKd0y4Gf33

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      f5b73449c2676a77e450daf2b857b7ce7e6d71f1df413c71121a8fe75611e106

    • Size

      2.0MB

    • MD5

      106ef53fb7ce9154d94f9bdc2c500bc9

    • SHA1

      a40d67c5f8fa2a942bde71a545e9e992f13da6b8

    • SHA256

      f5b73449c2676a77e450daf2b857b7ce7e6d71f1df413c71121a8fe75611e106

    • SHA512

      b6784bff0fde2276a5dab1f2b562760f665e94c60380f9a2b2739b29f1897aebe86e31a2c3b7d343906b296d8a698c32c2593848e2f2ab77257f46b9a5f35201

    • SSDEEP

      49152:Xoeqhqi7TSiZHIeakF61r4jfyfAX2tNs6F2jF5KoH/8x:Xa/n/ZCkYVgQAS66F2jF1

    Score
    10/10
    darkcometêôýíñ ìïíïevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks