darkcomet | bdca0dc5a747283dda93176036564a0637e287a077951cc394e1acc65404821c | Triage

Sharing

General

Target

fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118
Size

816KB
Sample

240421-fmw8gacb6s
MD5

fe7cff60621bc39bcb6b06aa89eab455
SHA1

347dfeb8fe8131eb47511731f4aebe061232ddd6
SHA256

bdca0dc5a747283dda93176036564a0637e287a077951cc394e1acc65404821c
SHA512

dee269d07e6e5055ddd02f63b99ce6879092242ee5c009e62967df0ec44ff4d9b6c86a13b3e3e0489c89fb56e347fd6a4b7d91c09de2d943c14f4cdda8ed5c1b
SSDEEP

12288:/KM2wD/U1gmeDvMo/cxdnB3DeomG/SHfLqdY6k0DNlHWZQW9:/KM9TUjeDvMfrVDZmG/STqm0DnWa0

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  fe7cff60621bc39bcb6b06aa89eab455_JaffaCakes118
- Size
  
  816KB
- MD5
  
  fe7cff60621bc39bcb6b06aa89eab455
- SHA1
  
  347dfeb8fe8131eb47511731f4aebe061232ddd6
- SHA256
  
  bdca0dc5a747283dda93176036564a0637e287a077951cc394e1acc65404821c
- SHA512
  
  dee269d07e6e5055ddd02f63b99ce6879092242ee5c009e62967df0ec44ff4d9b6c86a13b3e3e0489c89fb56e347fd6a4b7d91c09de2d943c14f4cdda8ed5c1b
- SSDEEP
  
  12288:/KM2wD/U1gmeDvMo/cxdnB3DeomG/SHfLqdY6k0DNlHWZQW9:/KM9TUjeDvMfrVDZmG/STqm0DnWa0
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan