Overview

overview

10

Static

static

10

97e952e79c...c8.exe

windows7-x64

10

97e952e79c...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c4633cedf3f1b0c1527012a4f67d9a01.bin

  • Size

    314KB

  • Sample

    240413-b7wp8ach6x

  • MD5

    af167672154f9105f2f05e7120c5b140

  • SHA1

    47ad2b61a70235164e9f02b74f8efff18857370b

  • SHA256

    88b021b7ca90fd43794747c2a417e74a70c494276d4ebc3cee4c5c9b0d1f68ad

  • SHA512

    89147e8e6adf5f65baf8fc07bfb91d1d76180ade1228db5dd6b8d4509461327f95a218de8ea74d279caca03ae66fb84c487e196fc3d54246d532aa09b9e0b414

  • SSDEEP

    6144:fOjhRj4Ne8Azjtl5ckiZJqxLoNlX2Jyez/tbAc106uasyrFUcdDD8lqPpoHFGdzt:fshZ4U8O/c9sx0N12JyCtbAc10oxUWEg

Score
10/10
darkcometsazanpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

0.tcp.eu.ngrok.io:19165:19165

Mutex

DC_MUTEX-AZWBJ2E

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Py8v2wbhf6PU

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe

    • Size

      663KB

    • MD5

      c4633cedf3f1b0c1527012a4f67d9a01

    • SHA1

      221067b2868decbddcaf4e1758dfd9c1e7fced94

    • SHA256

      97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8

    • SHA512

      87c107bf0c04b2ffc94fe1f2dd9df5b3e19fee67e15620dab90fa8abac90002f62178ca5fd2d3994b76a156c9b7ae690cf76cc7397c915e75aa445aa60b7c2a4

    • SSDEEP

      12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:aZ1xuVVjfFoynPaVBUR8f+kN10Ed

    Score
    10/10
    darkcometsazanpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks