Overview

overview

10

Static

static

a773504c2d...df.exe

windows7-x64

10

a773504c2d...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a773504c2d6b43a8487bae5e03a25da29edb50d8a5b37d65b62b9671ce744adf

  • Size

    1.1MB

  • Sample

    221205-lvambscd5y

  • MD5

    a1125ba46c4a93d34420370e615f5ec4

  • SHA1

    453bbb23777e918ec060ec5b67a1a868d6c11792

  • SHA256

    a773504c2d6b43a8487bae5e03a25da29edb50d8a5b37d65b62b9671ce744adf

  • SHA512

    37ec170cfb8a0b64d845a92f586cba0892cfc7f0e859358115f931cc1fa6216a45300c974a783c9afbec870caf771e2fbc9b7e954d054e31b370554bc9a77f50

  • SSDEEP

    24576:vUD3WVqWznA1ICUKy2t0ZeOZ73oGO/bDZE1tcsRR1:emMWznA1GKy2mkOZ74p//ZETRR1

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      a773504c2d6b43a8487bae5e03a25da29edb50d8a5b37d65b62b9671ce744adf

    • Size

      1.1MB

    • MD5

      a1125ba46c4a93d34420370e615f5ec4

    • SHA1

      453bbb23777e918ec060ec5b67a1a868d6c11792

    • SHA256

      a773504c2d6b43a8487bae5e03a25da29edb50d8a5b37d65b62b9671ce744adf

    • SHA512

      37ec170cfb8a0b64d845a92f586cba0892cfc7f0e859358115f931cc1fa6216a45300c974a783c9afbec870caf771e2fbc9b7e954d054e31b370554bc9a77f50

    • SSDEEP

      24576:vUD3WVqWznA1ICUKy2t0ZeOZ73oGO/bDZE1tcsRR1:emMWznA1GKy2mkOZ74p//ZETRR1

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks