Overview

overview

10

Static

static

eefb7e6f07...e4.exe

windows7-x64

10

eefb7e6f07...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eefb7e6f07e9cc6b7a631250a9832a73d3341a5cd89a8c1a979ef9621c682de4

  • Size

    4.9MB

  • Sample

    221207-kbhyxsab96

  • MD5

    0f1c2db4971cb37da97ed6dff6f071b8

  • SHA1

    1a11434db84ab8189cca0e73c439ed862de17df0

  • SHA256

    eefb7e6f07e9cc6b7a631250a9832a73d3341a5cd89a8c1a979ef9621c682de4

  • SHA512

    7797adf05623c865710681f0b4572dbd39e30c996dbfe959b732c07fe646fc829c7004f94ff8884c1687b98863b84bb3c04573a87d95d9a627777c8f6a21d8fd

  • SSDEEP

    49152:TWpFbzP8NKERLbzZAbS+r8StQmMqRSYtPZOpiz+13zcQWQY0JxX3Sr:

Score
10/10
darkcomethawkeyeevasionkeyloggerpersistenceratspywarestealertrojanupx

Malware Config

Targets

    • Target

      eefb7e6f07e9cc6b7a631250a9832a73d3341a5cd89a8c1a979ef9621c682de4

    • Size

      4.9MB

    • MD5

      0f1c2db4971cb37da97ed6dff6f071b8

    • SHA1

      1a11434db84ab8189cca0e73c439ed862de17df0

    • SHA256

      eefb7e6f07e9cc6b7a631250a9832a73d3341a5cd89a8c1a979ef9621c682de4

    • SHA512

      7797adf05623c865710681f0b4572dbd39e30c996dbfe959b732c07fe646fc829c7004f94ff8884c1687b98863b84bb3c04573a87d95d9a627777c8f6a21d8fd

    • SSDEEP

      49152:TWpFbzP8NKERLbzZAbS+r8StQmMqRSYtPZOpiz+13zcQWQY0JxX3Sr:

    Score
    10/10
    darkcomethawkeyeevasionkeyloggerpersistenceratspywarestealertrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks