Overview

overview

10

Static

static

5

553b073e14...aN.exe

windows7-x64

10

553b073e14...aN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    553b073e141c065f89e2247511c1e8fbabb624c71e07ff1e38b14197c336c69aN

  • Size

    1.3MB

  • Sample

    241005-v1bw1sxfrj

  • MD5

    00004abf734a7d34d6665e1daea238c0

  • SHA1

    07efc6830c9128c25c88cf6401af2b01442274f2

  • SHA256

    553b073e141c065f89e2247511c1e8fbabb624c71e07ff1e38b14197c336c69a

  • SHA512

    d5e8f252fe45d6276cbaee48fbd73e38d9c093f77fbd7d9f392556a619e5865f6e3df9d78c89f7ed49971fd2e9aca88a6f7ab7324300a9c9c0c47043ffe5aeb7

  • SSDEEP

    24576:k4lavt0LkLL9IMixoEgeany0Bex3XgoOvOr8FozBi2eoTq9MmCS:zkwkn9IMHeany063Xgxv+ZzBOqaPCS

Score
10/10
darkcometguest16discoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

10.10.0.100:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    jXmwh2j5mvF3

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Targets

    • Target

      553b073e141c065f89e2247511c1e8fbabb624c71e07ff1e38b14197c336c69aN

    • Size

      1.3MB

    • MD5

      00004abf734a7d34d6665e1daea238c0

    • SHA1

      07efc6830c9128c25c88cf6401af2b01442274f2

    • SHA256

      553b073e141c065f89e2247511c1e8fbabb624c71e07ff1e38b14197c336c69a

    • SHA512

      d5e8f252fe45d6276cbaee48fbd73e38d9c093f77fbd7d9f392556a619e5865f6e3df9d78c89f7ed49971fd2e9aca88a6f7ab7324300a9c9c0c47043ffe5aeb7

    • SSDEEP

      24576:k4lavt0LkLL9IMixoEgeany0Bex3XgoOvOr8FozBi2eoTq9MmCS:zkwkn9IMHeany063Xgxv+ZzBOqaPCS

    Score
    10/10
    darkcometguest16discoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks