Overview

overview

10

Static

static

3

f6964be59c...18.exe

windows7-x64

10

f6964be59c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6964be59c0dcfc3bcf276ead2eeccd8_JaffaCakes118

  • Size

    661KB

  • Sample

    240417-y3ktgsdc57

  • MD5

    f6964be59c0dcfc3bcf276ead2eeccd8

  • SHA1

    97de8a0c4d5048d8523e2631f04354f71fb35a3a

  • SHA256

    568c425570f2be7ba94db76f173f1e1812c57b5568cc1c4d20ae94608b90f1d1

  • SHA512

    7ad90806b02180fc2e17e5cfd6db750a36bc4020c61aa418aba739655174391b01609ae9d38f3a7ff4485bb2b52b7d7763753ec23c15df1839d859d98964e05d

  • SSDEEP

    12288:TsBMe3QUYDugu73AUy1uOzOeYFCJAbiIvRNsqZaYVJyc4Nwp:QB/YDuy5zOyAFv3gYVJj4N

Score
10/10
darkcometevasionrattrojanupx

Malware Config

Targets

    • Target

      f6964be59c0dcfc3bcf276ead2eeccd8_JaffaCakes118

    • Size

      661KB

    • MD5

      f6964be59c0dcfc3bcf276ead2eeccd8

    • SHA1

      97de8a0c4d5048d8523e2631f04354f71fb35a3a

    • SHA256

      568c425570f2be7ba94db76f173f1e1812c57b5568cc1c4d20ae94608b90f1d1

    • SHA512

      7ad90806b02180fc2e17e5cfd6db750a36bc4020c61aa418aba739655174391b01609ae9d38f3a7ff4485bb2b52b7d7763753ec23c15df1839d859d98964e05d

    • SSDEEP

      12288:TsBMe3QUYDugu73AUy1uOzOeYFCJAbiIvRNsqZaYVJyc4Nwp:QB/YDuy5zOyAFv3gYVJj4N

    Score
    10/10
    darkcometevasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Modify Registry

5
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks