General

  • Target

    a01e7346b794c9b5b8af950eaffb566b

  • Size

    1.3MB

  • Sample

    240216-l9vaaagd2x

  • MD5

    a01e7346b794c9b5b8af950eaffb566b

  • SHA1

    a9526b3079c87b7a92f7202ae8a047ad5389f12b

  • SHA256

    d113a494b7df91ea36fa153a94280f6819098123101c60cd87903f8c41ffbaf6

  • SHA512

    220375e6e32ecb9f2fe5f76d6ff990afbc9d6ed0a09f1d3b21c9ab724a77646fe609c0e0722021afe2136331a53baefee0fd0523f32df2d750c2ae91660cd511

  • SSDEEP

    12288:jomgmD4NLGSlwQO/NslLmzPrjB023ka2pJbzPaGaj4KHPBlOCFg9z8wEjJKW1QQJ:M5wjL0WGhAm+E+Ect8MQL+W8x42

Malware Config

Targets

    • Target

      a01e7346b794c9b5b8af950eaffb566b

    • Size

      1.3MB

    • MD5

      a01e7346b794c9b5b8af950eaffb566b

    • SHA1

      a9526b3079c87b7a92f7202ae8a047ad5389f12b

    • SHA256

      d113a494b7df91ea36fa153a94280f6819098123101c60cd87903f8c41ffbaf6

    • SHA512

      220375e6e32ecb9f2fe5f76d6ff990afbc9d6ed0a09f1d3b21c9ab724a77646fe609c0e0722021afe2136331a53baefee0fd0523f32df2d750c2ae91660cd511

    • SSDEEP

      12288:jomgmD4NLGSlwQO/NslLmzPrjB023ka2pJbzPaGaj4KHPBlOCFg9z8wEjJKW1QQJ:M5wjL0WGhAm+E+Ect8MQL+W8x42

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks