darkcomet | 5971fe6ee167e4e767e4ef62002ac08990f93b48dc8aab6d854cb6cf2cb15751 | Triage

Sharing

General

Target

52fbb186a05c9546fbcb743a39932b4d_JaffaCakes118
Size

1.3MB
Sample

241017-wnrblsxgla
MD5

52fbb186a05c9546fbcb743a39932b4d
SHA1

8ac8bddb2601007e9452642936dec0677d046e99
SHA256

5971fe6ee167e4e767e4ef62002ac08990f93b48dc8aab6d854cb6cf2cb15751
SHA512

f79f2f23f4728acbbae3b1bba6d81b0f882b8eb25fd84883308790e4726cc169a9fcb1cfc43ac55c773e2cfaa40ceed92df0d8ee917e2bc2d8b85e47c54ae7b1
SSDEEP

24576:zBoIjIbgyLC495467nMEgB3JFvLv4njC3N8oqZigGWt6vhNnOpcEe2ZFVA:zx8bdLp542ME6FvLvejCd8oVgGnvhNOo

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Targets

- Target
  
  52fbb186a05c9546fbcb743a39932b4d_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  52fbb186a05c9546fbcb743a39932b4d
- SHA1
  
  8ac8bddb2601007e9452642936dec0677d046e99
- SHA256
  
  5971fe6ee167e4e767e4ef62002ac08990f93b48dc8aab6d854cb6cf2cb15751
- SHA512
  
  f79f2f23f4728acbbae3b1bba6d81b0f882b8eb25fd84883308790e4726cc169a9fcb1cfc43ac55c773e2cfaa40ceed92df0d8ee917e2bc2d8b85e47c54ae7b1
- SSDEEP
  
  24576:zBoIjIbgyLC495467nMEgB3JFvLv4njC3N8oqZigGWt6vhNnOpcEe2ZFVA:zx8bdLp542ME6FvLvejCd8oVgGnvhNOo
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan