darkcomet | ce52276672f31f36d89450798b7bf3a129f82290eb4c8d5dd756f10026953bc6 | Triage

Sharing

General

Target

f5bdb0bb069c87b7efff6e3b83890187_JaffaCakes118
Size

744KB
Sample

240417-pc1ycaec53
MD5

f5bdb0bb069c87b7efff6e3b83890187
SHA1

4d1ad24b615fdba85dde5279517e186484c8f712
SHA256

ce52276672f31f36d89450798b7bf3a129f82290eb4c8d5dd756f10026953bc6
SHA512

2d5086d499ef21fb3a4340e1f49f09b57d044fe73913fe6ac84f69626300ba87be6519dcfe1394aa3183aa962b18a32e8597cb5e1621716f72420422a580a30f
SSDEEP

12288:xD4MsN/6Mhaty8mvwYsh09ZfNQBghCIEo4VNA05HxEpF1QPB5HlSR8FxfGw:mMsN/6MhaFmoJu9ZfHhHES0mFKlSGfB

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  f5bdb0bb069c87b7efff6e3b83890187_JaffaCakes118
- Size
  
  744KB
- MD5
  
  f5bdb0bb069c87b7efff6e3b83890187
- SHA1
  
  4d1ad24b615fdba85dde5279517e186484c8f712
- SHA256
  
  ce52276672f31f36d89450798b7bf3a129f82290eb4c8d5dd756f10026953bc6
- SHA512
  
  2d5086d499ef21fb3a4340e1f49f09b57d044fe73913fe6ac84f69626300ba87be6519dcfe1394aa3183aa962b18a32e8597cb5e1621716f72420422a580a30f
- SSDEEP
  
  12288:xD4MsN/6Mhaty8mvwYsh09ZfNQBghCIEo4VNA05HxEpF1QPB5HlSR8FxfGw:mMsN/6MhaFmoJu9ZfHhHES0mFKlSGfB
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan