darkcomet | 6d648e4569f1b55bcae974429422adc21e00f6e7491bdf202dab13e2f09306af | Triage

Sharing

Copy URL Twitter E-mail

General

Target

75e5dc2cbd8debefd7737eb98c46b06e
Size

806KB
Sample

231226-rw6ztahba9
MD5

75e5dc2cbd8debefd7737eb98c46b06e
SHA1

41dd185cc263d9894a16a8b2f2c71ba45e60c7c4
SHA256

6d648e4569f1b55bcae974429422adc21e00f6e7491bdf202dab13e2f09306af
SHA512

f4438416c1183ef0d2c58db22c3025dc0212df87655b9a80b1a0ad0bf6f31492643a571e2b3d044e406d55c19be7c53c8608d7e6a64f73c25b886ac17e63c2c3
SSDEEP

24576:/PlbXM14SmQ3BV47en9x/ZindWQoXxb/Mn:/tbXMyIxRlydWQCxb

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  75e5dc2cbd8debefd7737eb98c46b06e
- Size
  
  806KB
- MD5
  
  75e5dc2cbd8debefd7737eb98c46b06e
- SHA1
  
  41dd185cc263d9894a16a8b2f2c71ba45e60c7c4
- SHA256
  
  6d648e4569f1b55bcae974429422adc21e00f6e7491bdf202dab13e2f09306af
- SHA512
  
  f4438416c1183ef0d2c58db22c3025dc0212df87655b9a80b1a0ad0bf6f31492643a571e2b3d044e406d55c19be7c53c8608d7e6a64f73c25b886ac17e63c2c3
- SSDEEP
  
  24576:/PlbXM14SmQ3BV47en9x/ZindWQoXxb/Mn:/tbXMyIxRlydWQCxb
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan