Overview

overview

10

Static

static

10

9cca92b853...65.exe

windows7-x64

10

9cca92b853...65.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9cca92b85337367da00d82bbbedca4a72d5f40d06ecb6f4e0522655ac8153f65

  • Size

    804KB

  • Sample

    221206-ptwpyscd8s

  • MD5

    f793c73c889ea739bdea6deac9d7d142

  • SHA1

    f6d7cb299358f0ef32f4beb55b9cb2e220a7706b

  • SHA256

    9cca92b85337367da00d82bbbedca4a72d5f40d06ecb6f4e0522655ac8153f65

  • SHA512

    f66fea5b8ea2f0a14234a193c0420dd3c836c13d84618451d1166e7fb3e412836642cd5b0093988beba41ccd68d864515f6f36ee980f6310144d0f815b3b5afc

  • SSDEEP

    12288:kaAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuN/:VAEE3uBDhynCylQgi63O9+VuN

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      9cca92b85337367da00d82bbbedca4a72d5f40d06ecb6f4e0522655ac8153f65

    • Size

      804KB

    • MD5

      f793c73c889ea739bdea6deac9d7d142

    • SHA1

      f6d7cb299358f0ef32f4beb55b9cb2e220a7706b

    • SHA256

      9cca92b85337367da00d82bbbedca4a72d5f40d06ecb6f4e0522655ac8153f65

    • SHA512

      f66fea5b8ea2f0a14234a193c0420dd3c836c13d84618451d1166e7fb3e412836642cd5b0093988beba41ccd68d864515f6f36ee980f6310144d0f815b3b5afc

    • SSDEEP

      12288:kaAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuN/:VAEE3uBDhynCylQgi63O9+VuN

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks