darkcomet | 66d669631c0011937b0f501d1b074449fbf8a1a2e78fee978e20c329ee59a0c6 | Triage

Sharing

General

Target

19aa5640223a48f6447e6e8b8d82b909_JaffaCakes118
Size

620KB
Sample

241006-zly58azajd
MD5

19aa5640223a48f6447e6e8b8d82b909
SHA1

f0346a4ba413da9c55ac2b49b77ac7bd222cd97a
SHA256

66d669631c0011937b0f501d1b074449fbf8a1a2e78fee978e20c329ee59a0c6
SHA512

a13b857d1a5d54bd29933d64991ff809e7a3f64b2df139f473890c58c15ea66bc14dd1d80e3149439049d78a57a4cd53df0c2c2bf5e57ab84aa250eff76c17a1
SSDEEP

12288:sZeVQkTrvj4s70AgmXwiqQHbnJpaE3EAYVSFaaZjAIREsjfhNcMvU:swQkTf4xATgiqfE3E3VuTjTrIqU

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  19aa5640223a48f6447e6e8b8d82b909_JaffaCakes118
- Size
  
  620KB
- MD5
  
  19aa5640223a48f6447e6e8b8d82b909
- SHA1
  
  f0346a4ba413da9c55ac2b49b77ac7bd222cd97a
- SHA256
  
  66d669631c0011937b0f501d1b074449fbf8a1a2e78fee978e20c329ee59a0c6
- SHA512
  
  a13b857d1a5d54bd29933d64991ff809e7a3f64b2df139f473890c58c15ea66bc14dd1d80e3149439049d78a57a4cd53df0c2c2bf5e57ab84aa250eff76c17a1
- SSDEEP
  
  12288:sZeVQkTrvj4s70AgmXwiqQHbnJpaE3EAYVSFaaZjAIREsjfhNcMvU:swQkTf4xATgiqfE3E3VuTjTrIqU
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan