Overview

overview

10

Static

static

3

299cdc68b4...18.exe

windows7-x64

10

299cdc68b4...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    299cdc68b4e2c8c7a16d5bba1591eb98_JaffaCakes118

  • Size

    644KB

  • Sample

    240706-3leclazcrg

  • MD5

    299cdc68b4e2c8c7a16d5bba1591eb98

  • SHA1

    37c9b56e363943a4775c785d38d3b0b647aab92b

  • SHA256

    dcf842986c2b32e825cb2f680acb8d3f57623680ef31084bf8822703a96d6505

  • SHA512

    40d9b6510467220f84b8588f59426afd9e47be3ca760857184c1cc05ae8d71b182c333e4e0f0833cf6ba6091d705e3b3846aee1a165db63833ab6d6f9b9dc4bb

  • SSDEEP

    12288:jKdq7S6lbPd1/jkaMGXDv657Z81qyCQfPF30tlI28hjyCP:jKdCl7dp3XDv6z8Eydf10tmDxyi

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      299cdc68b4e2c8c7a16d5bba1591eb98_JaffaCakes118

    • Size

      644KB

    • MD5

      299cdc68b4e2c8c7a16d5bba1591eb98

    • SHA1

      37c9b56e363943a4775c785d38d3b0b647aab92b

    • SHA256

      dcf842986c2b32e825cb2f680acb8d3f57623680ef31084bf8822703a96d6505

    • SHA512

      40d9b6510467220f84b8588f59426afd9e47be3ca760857184c1cc05ae8d71b182c333e4e0f0833cf6ba6091d705e3b3846aee1a165db63833ab6d6f9b9dc4bb

    • SSDEEP

      12288:jKdq7S6lbPd1/jkaMGXDv657Z81qyCQfPF30tlI28hjyCP:jKdCl7dp3XDv6z8Eydf10tmDxyi

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks