Overview

overview

10

Static

static

bed5f13fa6...54.exe

windows7-x64

10

bed5f13fa6...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bed5f13fa6b1bc97b45f51896de414678f3b844d43613196dbe477dc26b36b54

  • Size

    1.4MB

  • Sample

    221203-grzd3aag56

  • MD5

    9dd38615196e4992a915698ed23d2aff

  • SHA1

    67b50b4aa1b9e738b1c7d902e10dc66b6ab52681

  • SHA256

    bed5f13fa6b1bc97b45f51896de414678f3b844d43613196dbe477dc26b36b54

  • SHA512

    1d4e280a002dd09ac102b1790f27fb68a28b0d1b1c6f73c7c25ca1f20971a5d09ed172888fe8317803600826d1a7cf4ae4f808652999bab418c1c52ceb1fdaf8

  • SSDEEP

    24576:/SY34IXoDdLgzm1mvPJvVp9q8x2OVdtX95rZBlKsKEw2RTISmO:/NITovPJvHn28R/bLRTI

Score
10/10
darkcometminecraftgett0111evasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

minecraftgett0111

C2

qwertyfuck.no-ip.biz:1604

Mutex

DC_MUTEX-GNGL16E

Attributes
  • gencode

    EbPKlSTAN5A7

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      bed5f13fa6b1bc97b45f51896de414678f3b844d43613196dbe477dc26b36b54

    • Size

      1.4MB

    • MD5

      9dd38615196e4992a915698ed23d2aff

    • SHA1

      67b50b4aa1b9e738b1c7d902e10dc66b6ab52681

    • SHA256

      bed5f13fa6b1bc97b45f51896de414678f3b844d43613196dbe477dc26b36b54

    • SHA512

      1d4e280a002dd09ac102b1790f27fb68a28b0d1b1c6f73c7c25ca1f20971a5d09ed172888fe8317803600826d1a7cf4ae4f808652999bab418c1c52ceb1fdaf8

    • SSDEEP

      24576:/SY34IXoDdLgzm1mvPJvVp9q8x2OVdtX95rZBlKsKEw2RTISmO:/NITovPJvHn28R/bLRTI

    Score
    10/10
    darkcometminecraftgett0111evasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks