General

  • Target

    1305261a64890954599fb2d7578a5b20047ea415d00d5a219f7ae06c21c72a52

  • Size

    283KB

  • Sample

    240413-xegaqafh98

  • MD5

    dd58cddd601ba0d1d7fc157136a8a1c5

  • SHA1

    344292fb97107016fb925d93ff81cea9a7e92493

  • SHA256

    1305261a64890954599fb2d7578a5b20047ea415d00d5a219f7ae06c21c72a52

  • SHA512

    111e77ca531c6c5ccbb4d27308a4209014b9503a220e1e0b48bb63cde0200013a03963ebaa6e63bb0957e4038c5709e4017228934f74a16e1f3517381257a872

  • SSDEEP

    6144:7cNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0P0GT:7cWkbgTYWnYnt/IDYhP0GT

Malware Config

Extracted

Family

darkcomet

Botnet

220

C2

strateg.ddns.net:220

Mutex

DC_MUTEX-17TCUZ8

Attributes
  • InstallPath

    MSDCSC\explorer.exe

  • gencode

    ECU92camneaf

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      1305261a64890954599fb2d7578a5b20047ea415d00d5a219f7ae06c21c72a52

    • Size

      283KB

    • MD5

      dd58cddd601ba0d1d7fc157136a8a1c5

    • SHA1

      344292fb97107016fb925d93ff81cea9a7e92493

    • SHA256

      1305261a64890954599fb2d7578a5b20047ea415d00d5a219f7ae06c21c72a52

    • SHA512

      111e77ca531c6c5ccbb4d27308a4209014b9503a220e1e0b48bb63cde0200013a03963ebaa6e63bb0957e4038c5709e4017228934f74a16e1f3517381257a872

    • SSDEEP

      6144:7cNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0P0GT:7cWkbgTYWnYnt/IDYhP0GT

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Windows security bypass

    • UPX dump on OEP (original entry point)

    • Disables RegEdit via registry modification

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks