darkcomet | 145c0a75b153103b0393ef16827f1e4047205566261834cf66d53ba724ae1453 | Triage

Sharing

General

Target

0bec3d273f515bf5201f8e105b20c294_JaffaCakes118
Size

944KB
Sample

240625-ccx58svbnc
MD5

0bec3d273f515bf5201f8e105b20c294
SHA1

9bb367cb9cda49e1b8191a629c052d37bcd0eaa9
SHA256

145c0a75b153103b0393ef16827f1e4047205566261834cf66d53ba724ae1453
SHA512

175ff33e285da284dcfaf05e84892727d167174541ae67399c90a2d306c91bfd30ca2200c3ef1fa56d7624542e37d92f3f5c933424b691efafb6676e62fc5602
SSDEEP

12288:pFW3FQvHob7beW46L0MPRxNE5sqkzBRiFGq9CLRoWAMNgbBLXQSKEY/YECEwvY8a:ZPovjlqkzHwGfzWCYvEg74hDkF0n

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  0bec3d273f515bf5201f8e105b20c294_JaffaCakes118
- Size
  
  944KB
- MD5
  
  0bec3d273f515bf5201f8e105b20c294
- SHA1
  
  9bb367cb9cda49e1b8191a629c052d37bcd0eaa9
- SHA256
  
  145c0a75b153103b0393ef16827f1e4047205566261834cf66d53ba724ae1453
- SHA512
  
  175ff33e285da284dcfaf05e84892727d167174541ae67399c90a2d306c91bfd30ca2200c3ef1fa56d7624542e37d92f3f5c933424b691efafb6676e62fc5602
- SSDEEP
  
  12288:pFW3FQvHob7beW46L0MPRxNE5sqkzBRiFGq9CLRoWAMNgbBLXQSKEY/YECEwvY8a:ZPovjlqkzHwGfzWCYvEg74hDkF0n
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan