darkcomet | a4bdc360927c533b38e388c2dbce77dda3f03793557408fdf06f1935dc9cca80 | Triage

Sharing

General

Target

40399abf2fd406ffe2b6243026cb79a1_JaffaCakes118
Size

741KB
Sample

241013-q7pn8svblj
MD5

40399abf2fd406ffe2b6243026cb79a1
SHA1

64388c49d752237ec715a319691864113d5faa34
SHA256

a4bdc360927c533b38e388c2dbce77dda3f03793557408fdf06f1935dc9cca80
SHA512

184915fbc8f44bf714bcd270e3c61b9e9778bec3877bea216f0858a72ca2aadb4cf9ef5ddf973e1b0d678e1a3dd4fe4fa8e5d2dc25bc7d0333017eba447355bd
SSDEEP

12288:UQkPrGW1QBtr6wk8KNv0l/sd6QJdi39MujlaXIU7I0UxjjEILY:UZD03RwvS/K62i39Mujos0gE

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Targets

- Target
  
  40399abf2fd406ffe2b6243026cb79a1_JaffaCakes118
- Size
  
  741KB
- MD5
  
  40399abf2fd406ffe2b6243026cb79a1
- SHA1
  
  64388c49d752237ec715a319691864113d5faa34
- SHA256
  
  a4bdc360927c533b38e388c2dbce77dda3f03793557408fdf06f1935dc9cca80
- SHA512
  
  184915fbc8f44bf714bcd270e3c61b9e9778bec3877bea216f0858a72ca2aadb4cf9ef5ddf973e1b0d678e1a3dd4fe4fa8e5d2dc25bc7d0333017eba447355bd
- SSDEEP
  
  12288:UQkPrGW1QBtr6wk8KNv0l/sd6QJdi39MujlaXIU7I0UxjjEILY:UZD03RwvS/K62i39Mujos0gE
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan