Overview

overview

10

Static

static

c6cc388021...01.exe

windows7-x64

10

c6cc388021...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6cc3880215e9efdc78b6cab7f373390ccdb9615f6dcb2f1f92f8bd65b681101

  • Size

    2.7MB

  • Sample

    221203-fz6mnsca41

  • MD5

    349b587ed5fda616d179ba9a1718fb4c

  • SHA1

    d503cdd4bd462f182ff328cc262ec0f99486d6f4

  • SHA256

    c6cc3880215e9efdc78b6cab7f373390ccdb9615f6dcb2f1f92f8bd65b681101

  • SHA512

    29e079f1c4449e61231f79917ea1da21991855ff3790c356f2f0a5c70474221a518a060cb0405b3d30fcdab5017b0ed1e8dcc8f89ef3502301b4bf8290f986cd

  • SSDEEP

    24576:SKKTygi5eQlaRERr3Aui0K29imwteZGSzZt3cn5uXPBL7I7noV6jOIyz8+CQBKZq:+IKjOIy3DBKZFOeBYie

Score
10/10
darkcometphevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

PH

C2

justfordarkcomet.zapto.org:1604

127.0.0.1:1604

192.168.0.2:1604
Mutex

DC_MUTEX-E6M25ZF

Attributes
  • gencode

    ytR7Ej1ChUCo

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      c6cc3880215e9efdc78b6cab7f373390ccdb9615f6dcb2f1f92f8bd65b681101

    • Size

      2.7MB

    • MD5

      349b587ed5fda616d179ba9a1718fb4c

    • SHA1

      d503cdd4bd462f182ff328cc262ec0f99486d6f4

    • SHA256

      c6cc3880215e9efdc78b6cab7f373390ccdb9615f6dcb2f1f92f8bd65b681101

    • SHA512

      29e079f1c4449e61231f79917ea1da21991855ff3790c356f2f0a5c70474221a518a060cb0405b3d30fcdab5017b0ed1e8dcc8f89ef3502301b4bf8290f986cd

    • SSDEEP

      24576:SKKTygi5eQlaRERr3Aui0K29imwteZGSzZt3cn5uXPBL7I7noV6jOIyz8+CQBKZq:+IKjOIy3DBKZFOeBYie

    Score
    10/10
    darkcometphevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Modify Existing Service

1
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Hidden Files and Directories

2
T1158

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks