Overview

overview

10

Static

static

10

4ee8149d05...d2.exe

windows7-x64

10

4ee8149d05...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ee8149d053184567f4353b414aa705e444c3fcd22d03c20e46df3b10d981dd2

  • Size

    576KB

  • Sample

    240504-24p2daef4x

  • MD5

    f70587e0868a9c6f292bb0d14d32d550

  • SHA1

    e31781281ce47755411074c19906456df26d099a

  • SHA256

    4ee8149d053184567f4353b414aa705e444c3fcd22d03c20e46df3b10d981dd2

  • SHA512

    62d699745a9fb70c767c1aa8f0c95cddd0dc2668a69978e3498fa92440525402611a64ff28133cce3a080d7d507a1aa1e082550bfdb0707cfb75123ac6045edb

  • SSDEEP

    12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSf:+NWPkHlUfBgpuPdWzyuDTifgyWly

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      4ee8149d053184567f4353b414aa705e444c3fcd22d03c20e46df3b10d981dd2

    • Size

      576KB

    • MD5

      f70587e0868a9c6f292bb0d14d32d550

    • SHA1

      e31781281ce47755411074c19906456df26d099a

    • SHA256

      4ee8149d053184567f4353b414aa705e444c3fcd22d03c20e46df3b10d981dd2

    • SHA512

      62d699745a9fb70c767c1aa8f0c95cddd0dc2668a69978e3498fa92440525402611a64ff28133cce3a080d7d507a1aa1e082550bfdb0707cfb75123ac6045edb

    • SSDEEP

      12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSf:+NWPkHlUfBgpuPdWzyuDTifgyWly

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • UPX dump on OEP (original entry point)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks