Overview

overview

10

Static

static

863e6be64a...9b.exe

windows7-x64

10

863e6be64a...9b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    863e6be64a3c2d636c4b74572d46871a1d8de4e3cefd8d7b1c60c57ac72d279b

  • Size

    902KB

  • Sample

    221130-pgmlhsab38

  • MD5

    1ca381cbe63fb770608ce80b951abd3f

  • SHA1

    4e08463426fe36492d95aa99fc29c8928206de23

  • SHA256

    863e6be64a3c2d636c4b74572d46871a1d8de4e3cefd8d7b1c60c57ac72d279b

  • SHA512

    204291ce5d853e79aae7e9cb57ec7097a9d6974a55de3ba96138f3437bcbf019230c343b3e918354697a016f478fd085b6fe5b43f29fa5f2da9c159e38473591

  • SSDEEP

    12288:jZ+zBvLFWeeyK6Wh83EiZ8QT2ecDBp7JTezcV8D+rzo+9USRAJTHonP:cLAHydS83EA8TecTthzorSi2P

Score
10/10
darkcometd0cevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

d0c

C2

hf1.no-ip.biz:1604

hf1.no-ip.biz:1000
Mutex

DC_MUTEX-U25WR2D

Attributes
  • InstallPath

    ServiceFramework\Framework.exe

  • gencode

    YYdqE4m0VRbj

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MSFramework

Targets

    • Target

      863e6be64a3c2d636c4b74572d46871a1d8de4e3cefd8d7b1c60c57ac72d279b

    • Size

      902KB

    • MD5

      1ca381cbe63fb770608ce80b951abd3f

    • SHA1

      4e08463426fe36492d95aa99fc29c8928206de23

    • SHA256

      863e6be64a3c2d636c4b74572d46871a1d8de4e3cefd8d7b1c60c57ac72d279b

    • SHA512

      204291ce5d853e79aae7e9cb57ec7097a9d6974a55de3ba96138f3437bcbf019230c343b3e918354697a016f478fd085b6fe5b43f29fa5f2da9c159e38473591

    • SSDEEP

      12288:jZ+zBvLFWeeyK6Wh83EiZ8QT2ecDBp7JTezcV8D+rzo+9USRAJTHonP:cLAHydS83EA8TecTthzorSi2P

    Score
    10/10
    darkcometd0cevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks