darkcomet | b08e90b56896ed0fc2f0c789557a074609f8fac01d3f1bce5989e6520b04f905 | Triage

Sharing

General

Target

1cf1ea2c421d5129eec105eb3dc095f3_JaffaCakes118
Size

764KB
Sample

241007-mjcg8azgpk
MD5

1cf1ea2c421d5129eec105eb3dc095f3
SHA1

9b11f3e68586e184884d51d94c37d0f45dceeb86
SHA256

b08e90b56896ed0fc2f0c789557a074609f8fac01d3f1bce5989e6520b04f905
SHA512

7b71e92f30831333ad43057879d97fc3d7da0e045edc420951b769b5578bb17415002f6c0e9c31cdc318b42674e3df178bd4e2f8b438b54547267450907f8841
SSDEEP

12288:0vQ9HVuatI92apb5YgvFBmhP1bsGrq8gMj6s+98IFX0TfDqTeH+AIiJ6VIjT0PB5:R9HV5I1VTa1y83esmmTfeTAI66VIEBuW

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  1cf1ea2c421d5129eec105eb3dc095f3_JaffaCakes118
- Size
  
  764KB
- MD5
  
  1cf1ea2c421d5129eec105eb3dc095f3
- SHA1
  
  9b11f3e68586e184884d51d94c37d0f45dceeb86
- SHA256
  
  b08e90b56896ed0fc2f0c789557a074609f8fac01d3f1bce5989e6520b04f905
- SHA512
  
  7b71e92f30831333ad43057879d97fc3d7da0e045edc420951b769b5578bb17415002f6c0e9c31cdc318b42674e3df178bd4e2f8b438b54547267450907f8841
- SSDEEP
  
  12288:0vQ9HVuatI92apb5YgvFBmhP1bsGrq8gMj6s+98IFX0TfDqTeH+AIiJ6VIjT0PB5:R9HV5I1VTa1y83esmmTfeTAI66VIEBuW
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan