Overview

overview

10

Static

static

10

bef89e8fa9...60.exe

windows7-x64

10

bef89e8fa9...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bef89e8fa9ba49e46149ef4c43c66a12c38eb9d37491d1364bea60b24057dc60

  • Size

    777KB

  • Sample

    221201-ly1ypaga72

  • MD5

    5661ddb8e02f57893cd6b9347231d5a4

  • SHA1

    593519967b23ee11656fde31a395d7cb4dbcd4f9

  • SHA256

    bef89e8fa9ba49e46149ef4c43c66a12c38eb9d37491d1364bea60b24057dc60

  • SHA512

    7c1c8e268b92cedc904c93bab30b1aaf9b2a070b9456916d9861513f9465f7574f71c982310ea03ff375e7527c4b0915e23a1fa4d34cf716b1ef3eec7038387d

  • SSDEEP

    24576:g3nbWmJVJFwSddIXvfhqbiaxvRxq99Bjr:WamdZdcBYmp

Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Targets

    • Target

      bef89e8fa9ba49e46149ef4c43c66a12c38eb9d37491d1364bea60b24057dc60

    • Size

      777KB

    • MD5

      5661ddb8e02f57893cd6b9347231d5a4

    • SHA1

      593519967b23ee11656fde31a395d7cb4dbcd4f9

    • SHA256

      bef89e8fa9ba49e46149ef4c43c66a12c38eb9d37491d1364bea60b24057dc60

    • SHA512

      7c1c8e268b92cedc904c93bab30b1aaf9b2a070b9456916d9861513f9465f7574f71c982310ea03ff375e7527c4b0915e23a1fa4d34cf716b1ef3eec7038387d

    • SSDEEP

      24576:g3nbWmJVJFwSddIXvfhqbiaxvRxq99Bjr:WamdZdcBYmp

    Score
    10/10
    darkcometevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks