Overview

overview

10

Static

static

3

4fa46c9cc6...18.exe

windows7-x64

10

4fa46c9cc6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fa46c9cc60a82e8f8c36ce3b222c400_JaffaCakes118

  • Size

    620KB

  • Sample

    241016-3medzszcjc

  • MD5

    4fa46c9cc60a82e8f8c36ce3b222c400

  • SHA1

    a6e7f529eb00eb892e6c9948bb63b4ec402c483d

  • SHA256

    6b4b703aac09a525c969e781657c83a189522c7fe1f20c371e89c0ffcc32653e

  • SHA512

    1efce889855266711968712c6349435679fa3fb8f57bb30c6d651de217cfa9f707cd984bcd16ecfef7dc85022a7cf62f2e56508e817e36ce3853582fead4627c

  • SSDEEP

    12288:3ZeVQkTrvj4VIP/MGzSVUbn4RhjRE/WX0NZLS15CKTOZs05REsjfhNcMvq:3wQkTf4VI3bWWD4fjRr0Ne5CrZs6vrIZ

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      4fa46c9cc60a82e8f8c36ce3b222c400_JaffaCakes118

    • Size

      620KB

    • MD5

      4fa46c9cc60a82e8f8c36ce3b222c400

    • SHA1

      a6e7f529eb00eb892e6c9948bb63b4ec402c483d

    • SHA256

      6b4b703aac09a525c969e781657c83a189522c7fe1f20c371e89c0ffcc32653e

    • SHA512

      1efce889855266711968712c6349435679fa3fb8f57bb30c6d651de217cfa9f707cd984bcd16ecfef7dc85022a7cf62f2e56508e817e36ce3853582fead4627c

    • SSDEEP

      12288:3ZeVQkTrvj4VIP/MGzSVUbn4RhjRE/WX0NZLS15CKTOZs05REsjfhNcMvq:3wQkTf4VI3bWWD4fjRr0Ne5CrZs6vrIZ

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks