Overview

overview

10

Static

static

76403cb6bd...b0.exe

windows7-x64

10

76403cb6bd...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76403cb6bdbe8026323f0c035185b8da65f9326eb05b3095c5cdb6399e35b9b0

  • Size

    720KB

  • Sample

    221201-hk8jtsha4x

  • MD5

    3d65fef39d9a62779c83e5201d8199fb

  • SHA1

    dcebbb7eb9e1165ade8c2b86622d878da99d7822

  • SHA256

    76403cb6bdbe8026323f0c035185b8da65f9326eb05b3095c5cdb6399e35b9b0

  • SHA512

    63dc1c2330345c29b5f225f94b533398ed293204e1ff836806a79fc27325eb1e0940be445027e4f3af3a93a56d1000f4ede7c52e4c22a230a652574cbac228f2

  • SSDEEP

    12288:VPIgdjGu7ST5GhhouT3BK+QLpBUx7MXSLqny3hXd2RuSc1w929FE:VPXdjGu7STCQNpwwiLqnyRtuY7v

Score
10/10
darkcometmainpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Main

C2

proxydude1.no-ip.biz:1604

Mutex

DCMIN_MUTEX-FJVBHU6

Attributes
  • gencode

    MW7w2GyxBua5

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      76403cb6bdbe8026323f0c035185b8da65f9326eb05b3095c5cdb6399e35b9b0

    • Size

      720KB

    • MD5

      3d65fef39d9a62779c83e5201d8199fb

    • SHA1

      dcebbb7eb9e1165ade8c2b86622d878da99d7822

    • SHA256

      76403cb6bdbe8026323f0c035185b8da65f9326eb05b3095c5cdb6399e35b9b0

    • SHA512

      63dc1c2330345c29b5f225f94b533398ed293204e1ff836806a79fc27325eb1e0940be445027e4f3af3a93a56d1000f4ede7c52e4c22a230a652574cbac228f2

    • SSDEEP

      12288:VPIgdjGu7ST5GhhouT3BK+QLpBUx7MXSLqny3hXd2RuSc1w929FE:VPXdjGu7STCQNpwwiLqnyRtuY7v

    Score
    10/10
    darkcometmainpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks