Overview

overview

10

Static

static

c451cad76d...8d.exe

windows7-x64

10

c451cad76d...8d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c451cad76da1a4a39ea124ffc922e32688f8e2abf17ebdae93ac72048a12348d

  • Size

    912KB

  • Sample

    221203-f9ft1acg21

  • MD5

    54aff6329b0ce3a2d2f8cc426ecc17f1

  • SHA1

    f411f930447ba9d441faf4f25d442d4f07920254

  • SHA256

    c451cad76da1a4a39ea124ffc922e32688f8e2abf17ebdae93ac72048a12348d

  • SHA512

    be3ae08cd98b25e65f18086ea37741e5778bd0714e7b3cea520b3460e60036516c346ca694bf37a8960eab5dee40fdf318607c6025c14514b39d0f82e7ebb185

  • SSDEEP

    12288:7cUdGP0khPvPLkOHfYEJUaDE4ji6CAhamR+GzWPfQ/p6ML3nPOnihOmJAKzv88YW:7zALPvzrhE4jrCAhagEMLST0XzvuW

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      c451cad76da1a4a39ea124ffc922e32688f8e2abf17ebdae93ac72048a12348d

    • Size

      912KB

    • MD5

      54aff6329b0ce3a2d2f8cc426ecc17f1

    • SHA1

      f411f930447ba9d441faf4f25d442d4f07920254

    • SHA256

      c451cad76da1a4a39ea124ffc922e32688f8e2abf17ebdae93ac72048a12348d

    • SHA512

      be3ae08cd98b25e65f18086ea37741e5778bd0714e7b3cea520b3460e60036516c346ca694bf37a8960eab5dee40fdf318607c6025c14514b39d0f82e7ebb185

    • SSDEEP

      12288:7cUdGP0khPvPLkOHfYEJUaDE4ji6CAhamR+GzWPfQ/p6ML3nPOnihOmJAKzv88YW:7zALPvzrhE4jrCAhagEMLST0XzvuW

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks