darkcomet | 7ea1260abab8bb31edbcead9c0481c70decaddaf9bac16b7e6531bb159febe25 | Triage

Sharing

General

Target

3b37ef0e950b5f8785f210be1f4c13fa_JaffaCakes118
Size

1.0MB
Sample

241012-vyvakssbmf
MD5

3b37ef0e950b5f8785f210be1f4c13fa
SHA1

b724333203577227e9534cfc9720c841e78c18b8
SHA256

7ea1260abab8bb31edbcead9c0481c70decaddaf9bac16b7e6531bb159febe25
SHA512

4da79ffd56ac6790c3b739922a1681a46d974050e493ac630d4a9e48e0b28d95abe9a927780497101caa6050535c9998f86a6ab9ec420710726f87701aed7ab9
SSDEEP

24576:+//sINaIdZzyWO36ahRLJw7gxUKBZ8e6JsgMf1OTft4TF:+3eIZz66af6geKiJUf0T14TF

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  3b37ef0e950b5f8785f210be1f4c13fa_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  3b37ef0e950b5f8785f210be1f4c13fa
- SHA1
  
  b724333203577227e9534cfc9720c841e78c18b8
- SHA256
  
  7ea1260abab8bb31edbcead9c0481c70decaddaf9bac16b7e6531bb159febe25
- SHA512
  
  4da79ffd56ac6790c3b739922a1681a46d974050e493ac630d4a9e48e0b28d95abe9a927780497101caa6050535c9998f86a6ab9ec420710726f87701aed7ab9
- SSDEEP
  
  24576:+//sINaIdZzyWO36ahRLJw7gxUKBZ8e6JsgMf1OTft4TF:+3eIZz66af6geKiJUf0T14TF
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan