darkcomet | 9306d0e0b32e1d6d5676704ca163f09f7660987d1dfdd4e74e46271bc2af1b87 | Triage

Sharing

General

Target

4df4bc013741f7da95435c1c30cd2fc5_JaffaCakes118
Size

1.1MB
Sample

240716-mqn5la1eme
MD5

4df4bc013741f7da95435c1c30cd2fc5
SHA1

8a98e07431b9997734e67537cb3ebc257759c8f1
SHA256

9306d0e0b32e1d6d5676704ca163f09f7660987d1dfdd4e74e46271bc2af1b87
SHA512

fde7d1d7c30257db06e6ee5d3b94531a9cb594016df5290cc33565434096fd3db567ec2e9cf04e820aafffc8f9d93f592b4b19a1a8cee1649409f9d9da3a0134
SSDEEP

12288:XOhIFzU/bZ4ziPnVG8UmWa6eZNoCrVhSQr8Qoa+/MHLcwe4qoNTUsBGulHHYp1yh:XOhiwOiPVnVvHxr3DHFeMFhHiG

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  4df4bc013741f7da95435c1c30cd2fc5_JaffaCakes118
- Size
  
  1.1MB
- MD5
  
  4df4bc013741f7da95435c1c30cd2fc5
- SHA1
  
  8a98e07431b9997734e67537cb3ebc257759c8f1
- SHA256
  
  9306d0e0b32e1d6d5676704ca163f09f7660987d1dfdd4e74e46271bc2af1b87
- SHA512
  
  fde7d1d7c30257db06e6ee5d3b94531a9cb594016df5290cc33565434096fd3db567ec2e9cf04e820aafffc8f9d93f592b4b19a1a8cee1649409f9d9da3a0134
- SSDEEP
  
  12288:XOhIFzU/bZ4ziPnVG8UmWa6eZNoCrVhSQr8Qoa+/MHLcwe4qoNTUsBGulHHYp1yh:XOhiwOiPVnVvHxr3DHFeMFhHiG
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2