darkcomet | 98f4541cf8a2f3e1e22c0e864973c9b6000fbafba9946eaa4f9fbeccd2599d1e | Triage

Sharing

General

Target

401198bad9bc878a9f661e872334bde7_JaffaCakes118
Size

688KB
Sample

241013-qj2znashrq
MD5

401198bad9bc878a9f661e872334bde7
SHA1

002545f0c46de67e60d97773726c2c34fa207dad
SHA256

98f4541cf8a2f3e1e22c0e864973c9b6000fbafba9946eaa4f9fbeccd2599d1e
SHA512

7d441856c111434e823c5f00a25f20a8a7a9633198dedab26ef95242f8ddd9f8e335811880c2eb6931d27b8b65b72307c3c9334a900233e5998eda315b76fbb8
SSDEEP

12288:t+7YHb6n8562HJDi8LJM+L5oLMT7Q0bGiL7d1A/6XZt9m4mh:dGn85pptL+7iQK1ACXZtI4u

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  401198bad9bc878a9f661e872334bde7_JaffaCakes118
- Size
  
  688KB
- MD5
  
  401198bad9bc878a9f661e872334bde7
- SHA1
  
  002545f0c46de67e60d97773726c2c34fa207dad
- SHA256
  
  98f4541cf8a2f3e1e22c0e864973c9b6000fbafba9946eaa4f9fbeccd2599d1e
- SHA512
  
  7d441856c111434e823c5f00a25f20a8a7a9633198dedab26ef95242f8ddd9f8e335811880c2eb6931d27b8b65b72307c3c9334a900233e5998eda315b76fbb8
- SSDEEP
  
  12288:t+7YHb6n8562HJDi8LJM+L5oLMT7Q0bGiL7d1A/6XZt9m4mh:dGn85pptL+7iQK1ACXZtI4u
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan