Overview

overview

10

Static

static

3

739e065498...f9.exe

windows7-x64

10

739e065498...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    739e065498d059c844eefc77fc7b24f9

  • Size

    302KB

  • Sample

    240125-d1dxyafbh8

  • MD5

    739e065498d059c844eefc77fc7b24f9

  • SHA1

    211897080482917df88878aa243afdda50d21866

  • SHA256

    e7f623cc90369141f45b02da8a9356696fab3e633d4ed695100450d738659372

  • SHA512

    2ce2a9935b59702761e8def79c77afd1b4d84ad98106e0691c2830400f95967a44ff67c20fdcc06bd6d811b6e0ad9c57b7317a1348399778dffa815145a5e835

  • SSDEEP

    6144:KXjuCLdRD3rzCJaCnmYi7wSMsAeFJF03YCTdVJkpbl:1CxRD3reJ726sAeFT03FTdgJ

Score
10/10
darkcometevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      739e065498d059c844eefc77fc7b24f9

    • Size

      302KB

    • MD5

      739e065498d059c844eefc77fc7b24f9

    • SHA1

      211897080482917df88878aa243afdda50d21866

    • SHA256

      e7f623cc90369141f45b02da8a9356696fab3e633d4ed695100450d738659372

    • SHA512

      2ce2a9935b59702761e8def79c77afd1b4d84ad98106e0691c2830400f95967a44ff67c20fdcc06bd6d811b6e0ad9c57b7317a1348399778dffa815145a5e835

    • SSDEEP

      6144:KXjuCLdRD3rzCJaCnmYi7wSMsAeFJF03YCTdVJkpbl:1CxRD3reJ726sAeFT03FTdgJ

    Score
    10/10
    darkcometevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks