Overview

overview

10

Static

static

10

55d02e9d95...89.exe

windows7-x64

10

55d02e9d95...89.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    55d02e9d95c159024312eae3fbe7397a75f1ab7c3dfbf98afa04b40a60806989

  • Size

    661KB

  • Sample

    221205-hd5jlaab2y

  • MD5

    7c4da434dcbf80cd10288a8d105b4c38

  • SHA1

    aca86f1f980c6782b26fa2abf6dd03d2018b4ea4

  • SHA256

    55d02e9d95c159024312eae3fbe7397a75f1ab7c3dfbf98afa04b40a60806989

  • SHA512

    84672424a63e23908316f36af432b947e9fe95c18f5b318f5fc7c07b2f05fdc627856d11405b88270e4b1fc26f5b8bf54fb1464cc994a87bf14087c25f6f40df

  • SSDEEP

    12288:4XhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452US:+nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Ji

Score
10/10
darkcometretrypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Retry

C2

5.9.212.5:1604

winlogin.sytes.net:2520
Mutex

DC_MUTEX-01CMXUL

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    lX4xZzzTqhGy

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Retry

Targets

    • Target

      55d02e9d95c159024312eae3fbe7397a75f1ab7c3dfbf98afa04b40a60806989

    • Size

      661KB

    • MD5

      7c4da434dcbf80cd10288a8d105b4c38

    • SHA1

      aca86f1f980c6782b26fa2abf6dd03d2018b4ea4

    • SHA256

      55d02e9d95c159024312eae3fbe7397a75f1ab7c3dfbf98afa04b40a60806989

    • SHA512

      84672424a63e23908316f36af432b947e9fe95c18f5b318f5fc7c07b2f05fdc627856d11405b88270e4b1fc26f5b8bf54fb1464cc994a87bf14087c25f6f40df

    • SSDEEP

      12288:4XhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452US:+nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Ji

    Score
    10/10
    darkcometretrypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks