darkcomet | 8b26857cc0e77a877d255f80ce1f88f57d9067f25895a8cc7783deb4e1d6b9b8 | Triage

Sharing

General

Target

3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118
Size

916KB
Sample

240712-gdz4fa1amr
MD5

3c2dfdf5bc2a7d48db869607855cfde5
SHA1

b89384d71bf4cc843d61440f215d58aedf2c55ad
SHA256

8b26857cc0e77a877d255f80ce1f88f57d9067f25895a8cc7783deb4e1d6b9b8
SHA512

f1b5ef493d6ef5439d48e7f3aaa654f41c4ec8354017b5169ff3f8bda9674c7d5fd3455c96178c9e9033637c35ed9101522d54ba60ad28a62163fc33e4b9d055
SSDEEP

12288:msBQ7QwMO1w8SB1+TmqLsxZNLosy7FiDVv6xkYgfLk1woCOB6ZevWVBIy3yyLKae:ji5MO1to49Ls/hotYh6ilfLxZQqB3m

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  3c2dfdf5bc2a7d48db869607855cfde5_JaffaCakes118
- Size
  
  916KB
- MD5
  
  3c2dfdf5bc2a7d48db869607855cfde5
- SHA1
  
  b89384d71bf4cc843d61440f215d58aedf2c55ad
- SHA256
  
  8b26857cc0e77a877d255f80ce1f88f57d9067f25895a8cc7783deb4e1d6b9b8
- SHA512
  
  f1b5ef493d6ef5439d48e7f3aaa654f41c4ec8354017b5169ff3f8bda9674c7d5fd3455c96178c9e9033637c35ed9101522d54ba60ad28a62163fc33e4b9d055
- SSDEEP
  
  12288:msBQ7QwMO1w8SB1+TmqLsxZNLosy7FiDVv6xkYgfLk1woCOB6ZevWVBIy3yyLKae:ji5MO1to49Ls/hotYh6ilfLxZQqB3m
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan