Overview

overview

10

Static

static

bffa28e7f3...f6.exe

windows7-x64

10

bffa28e7f3...f6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

  • Size

    728KB

  • Sample

    221202-zep9qscb22

  • MD5

    c08b5c86a6862dce171417d4784a8e9d

  • SHA1

    58c7a720b3fbf7473a9c3fd278ba243545223aea

  • SHA256

    bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

  • SHA512

    f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

  • SSDEEP

    12288:Ykn1cJbceCA9W+DoGSSPI1YEoaPwJjoAOJq+QeiiGWM6wGAizk/Jq+QeiiGWM6wd:YGqI9A9WLjSPPEoMwJjoAD+QeiiGN8pq

Score
10/10
darkcometbootkitpersistencerattrojanupx

Malware Config

Targets

    • Target

      bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

    • Size

      728KB

    • MD5

      c08b5c86a6862dce171417d4784a8e9d

    • SHA1

      58c7a720b3fbf7473a9c3fd278ba243545223aea

    • SHA256

      bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

    • SHA512

      f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

    • SSDEEP

      12288:Ykn1cJbceCA9W+DoGSSPI1YEoaPwJjoAOJq+QeiiGWM6wGAizk/Jq+QeiiGWM6wd:YGqI9A9WLjSPPEoMwJjoAD+QeiiGN8pq

    Score
    10/10
    darkcometbootkitpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks