Overview

overview

10

Static

static

10

Foto Com Ela.exe

windows7-x64

10

Foto Com Ela.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Foto Com Ela.exe

  • Size

    821KB

  • Sample

    230410-qaf1tsbc2w

  • MD5

    49f227f4711ee473da73cefa669d6e0e

  • SHA1

    5af5186ee656020ee301c48dd92b9720d3ccf4ad

  • SHA256

    9ef45e8fc3c3333a7d2e95de498b82d09b11a3df6253fa172b7db084726a5c4e

  • SHA512

    63abcd3ef56ecfa80fed804c7993a0e54ab9d0fdf7bd15c5379f6e16ccd56f230edcb0d6c559cd837a892ff50b4944aaaec9bf95a253460352dbb14fbbb7249f

  • SSDEEP

    12288:TFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJ:h3nbWmJVJFwSddIXvfhqbiaxvRxq9

Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Targets

    • Target

      Foto Com Ela.exe

    • Size

      821KB

    • MD5

      49f227f4711ee473da73cefa669d6e0e

    • SHA1

      5af5186ee656020ee301c48dd92b9720d3ccf4ad

    • SHA256

      9ef45e8fc3c3333a7d2e95de498b82d09b11a3df6253fa172b7db084726a5c4e

    • SHA512

      63abcd3ef56ecfa80fed804c7993a0e54ab9d0fdf7bd15c5379f6e16ccd56f230edcb0d6c559cd837a892ff50b4944aaaec9bf95a253460352dbb14fbbb7249f

    • SSDEEP

      12288:TFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJ:h3nbWmJVJFwSddIXvfhqbiaxvRxq9

    Score
    10/10
    darkcometpersistencerattrojanevasion

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

2
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

7
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks