General

  • Target

    689c8df7cdc3899367ce63d36a0d59c3

  • Size

    659KB

  • Sample

    240119-zmwrgsddhj

  • MD5

    689c8df7cdc3899367ce63d36a0d59c3

  • SHA1

    cbb8c743c58ee2590d90bc680e33a0f60ad3f24a

  • SHA256

    6efb56158b4ee14f47dfe7b64e46df0930239bec1093e3e106cff4c76b35b062

  • SHA512

    0cb263f40d4bf750d8ac03cef454a10a0adac94cf9e09c2296fd1ea436beac874b2aeeb3bc6fd6ae3a39d6408ce45c2b9e265c126c7f3c7c07337c66180ff5ad

  • SSDEEP

    12288:h9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK6:XAQ6Zx9cxTmOrucTIEFSpOGX

Malware Config

Targets

    • Target

      689c8df7cdc3899367ce63d36a0d59c3

    • Size

      659KB

    • MD5

      689c8df7cdc3899367ce63d36a0d59c3

    • SHA1

      cbb8c743c58ee2590d90bc680e33a0f60ad3f24a

    • SHA256

      6efb56158b4ee14f47dfe7b64e46df0930239bec1093e3e106cff4c76b35b062

    • SHA512

      0cb263f40d4bf750d8ac03cef454a10a0adac94cf9e09c2296fd1ea436beac874b2aeeb3bc6fd6ae3a39d6408ce45c2b9e265c126c7f3c7c07337c66180ff5ad

    • SSDEEP

      12288:h9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK6:XAQ6Zx9cxTmOrucTIEFSpOGX

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Windows security bypass

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks