Overview

overview

10

Static

static

10

ydjtjdhdhjgf.exe

windows7-x64

10

ydjtjdhdhjgf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ydjtjdhdhjgf.exe

  • Size

    251KB

  • Sample

    230219-r21d8afc2s

  • MD5

    599cf9f4f6ef6e2f4033cafa7dd073b2

  • SHA1

    8d1480f20426e43e5dee454e7d69c9c2594cb89a

  • SHA256

    691f80ce05f5d787599cd990ae5f256c4aa40b66e2b58415f24883f8047827ad

  • SHA512

    0eae0f8ee3331b911f5965546962956b68687237feab2f8e25c5b609a7bad928bbd29a235c288174d0fab0b530b1d3c35bbda2b5f8d7f5fbb9d39744f7b639f2

  • SSDEEP

    6144:VcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37y3S:VcW7KEZlPzCy37y3

Score
10/10
darkcometguest16evasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

sussysdfffdfff343.duckdns.org:1604

Mutex

DC_MUTEX-GWZP22C

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    XdSkLijM5PKr

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicrosoftEdge

Targets

    • Target

      ydjtjdhdhjgf.exe

    • Size

      251KB

    • MD5

      599cf9f4f6ef6e2f4033cafa7dd073b2

    • SHA1

      8d1480f20426e43e5dee454e7d69c9c2594cb89a

    • SHA256

      691f80ce05f5d787599cd990ae5f256c4aa40b66e2b58415f24883f8047827ad

    • SHA512

      0eae0f8ee3331b911f5965546962956b68687237feab2f8e25c5b609a7bad928bbd29a235c288174d0fab0b530b1d3c35bbda2b5f8d7f5fbb9d39744f7b639f2

    • SSDEEP

      6144:VcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37y3S:VcW7KEZlPzCy37y3

    Score
    10/10
    darkcometguest16evasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks