darkcomet | hxxps://pixeldrain[.]com/u/yV91Kh1M | Triage

Sharing

General

Target

https://pixeldrain.com/u/yV91Kh1M
Sample

240212-y2nhzsbe5z

Score

10^/10

darkcomet guest16 evasion persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

5.39.43.50:1609

5.39.43.50:1610

Mutex

DC_MUTEX-NJU5JXL

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
CyfxMZvzryrY
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Targets

- Target
  
  https://pixeldrain.com/u/yV91Kh1M
Score

10^/10

darkcomet guest16 evasion persistence rat spyware stealer trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

urlscan1

behavioral1

darkcometguest16evasionpersistenceratspywarestealertrojan