Overview

overview

10

Static

static

3

ac1f09d0a7...ac.exe

windows7-x64

10

ac1f09d0a7...ac.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac1f09d0a797d231ac40d98c74851efbb1325d8c6351ddc251e0369c2f20c0ac

  • Size

    324KB

  • Sample

    240423-cr2f7sbf8x

  • MD5

    1da9d5eb17a25c1dcd2d7028867904aa

  • SHA1

    b75ab89bcf8306b9ef6d222478a004aba32ecd7f

  • SHA256

    ac1f09d0a797d231ac40d98c74851efbb1325d8c6351ddc251e0369c2f20c0ac

  • SHA512

    68b49d817d381fdd4d108f9b86c8aeb4a743000247878412c30d671be78d9eb3c019db62a4cc61f207e556389b9b3ff012f1e4c77d822ea42132f6aa292a94d2

  • SSDEEP

    6144:cvhFCYZdP5aHNn1s7C+3S4R5wQrV/YbZwZ3ssu4eqswN8s1Pf4NAGy5uRyXR6P+R:TQdwHNn1OCN4MQEZwUqsA

Score
10/10
darkcometguest16persistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

betclock.zapto.org:35000

Mutex

DC_MUTEX-LCQCVNZ

Attributes
  • gencode

    MGDU5FhLNYez

  • install

    false

  • offline_keylogger

    true

  • password

    0123456789

  • persistence

    false

Targets

    • Target

      ac1f09d0a797d231ac40d98c74851efbb1325d8c6351ddc251e0369c2f20c0ac

    • Size

      324KB

    • MD5

      1da9d5eb17a25c1dcd2d7028867904aa

    • SHA1

      b75ab89bcf8306b9ef6d222478a004aba32ecd7f

    • SHA256

      ac1f09d0a797d231ac40d98c74851efbb1325d8c6351ddc251e0369c2f20c0ac

    • SHA512

      68b49d817d381fdd4d108f9b86c8aeb4a743000247878412c30d671be78d9eb3c019db62a4cc61f207e556389b9b3ff012f1e4c77d822ea42132f6aa292a94d2

    • SSDEEP

      6144:cvhFCYZdP5aHNn1s7C+3S4R5wQrV/YbZwZ3ssu4eqswN8s1Pf4NAGy5uRyXR6P+R:TQdwHNn1OCN4MQEZwUqsA

    Score
    10/10
    darkcometguest16persistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks