Overview

overview

10

Static

static

c2b6267d24...fd.exe

windows7-x64

10

c2b6267d24...fd.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c2b6267d248f3d35b4a75f0452b8f963ac9252dc2ff60f65449205f66eddb2fd

  • Size

    872KB

  • Sample

    221203-v5dw6sed3v

  • MD5

    b868c311cd8bf84c932dcb252ebb21f0

  • SHA1

    4749ddefc1dc1f2dde0e5131c762379ebaadb9a1

  • SHA256

    c2b6267d248f3d35b4a75f0452b8f963ac9252dc2ff60f65449205f66eddb2fd

  • SHA512

    97f98131d99c0d2eafb6086a6eca10ae3f96efb0dbcf5996d5d8846755fa8ef56a53f43a31e19d436f6a5163605559b6a1bb826b0dd043be25379b2e8b46c771

  • SSDEEP

    24576:n/RsED2wvGq9c97bYmm/1ZXjqzyqR4LInnn4nnnnKcXYb2:n/Py+m7Mv/fOGq8Yb2

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      c2b6267d248f3d35b4a75f0452b8f963ac9252dc2ff60f65449205f66eddb2fd

    • Size

      872KB

    • MD5

      b868c311cd8bf84c932dcb252ebb21f0

    • SHA1

      4749ddefc1dc1f2dde0e5131c762379ebaadb9a1

    • SHA256

      c2b6267d248f3d35b4a75f0452b8f963ac9252dc2ff60f65449205f66eddb2fd

    • SHA512

      97f98131d99c0d2eafb6086a6eca10ae3f96efb0dbcf5996d5d8846755fa8ef56a53f43a31e19d436f6a5163605559b6a1bb826b0dd043be25379b2e8b46c771

    • SSDEEP

      24576:n/RsED2wvGq9c97bYmm/1ZXjqzyqR4LInnn4nnnnKcXYb2:n/Py+m7Mv/fOGq8Yb2

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks