darkcomet | 987610dc3a58d131c9f1d5a74b4ffb332d98f8ab42678006d1c09d1795ca0858 | Triage

Sharing

General

Target

652dcdf3001759e7aa4ebae996612070_JaffaCakes118
Size

718KB
Sample

241021-ck1akatbra
MD5

652dcdf3001759e7aa4ebae996612070
SHA1

cfdc99daa2c78495eb3d779d219be46c4bbd76cb
SHA256

987610dc3a58d131c9f1d5a74b4ffb332d98f8ab42678006d1c09d1795ca0858
SHA512

22fee00cd45a94e510255aa6b17312da58c878eaed8017b6e97d5b040b81b5c7c23130ab64b3b29b05e361fa9273a9402eb15f4d81accaf60b2488a9762d423e
SSDEEP

12288:CaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgd:TAEENIq8XwyVPQclDq/+WnpsS

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Targets

- Target
  
  652dcdf3001759e7aa4ebae996612070_JaffaCakes118
- Size
  
  718KB
- MD5
  
  652dcdf3001759e7aa4ebae996612070
- SHA1
  
  cfdc99daa2c78495eb3d779d219be46c4bbd76cb
- SHA256
  
  987610dc3a58d131c9f1d5a74b4ffb332d98f8ab42678006d1c09d1795ca0858
- SHA512
  
  22fee00cd45a94e510255aa6b17312da58c878eaed8017b6e97d5b040b81b5c7c23130ab64b3b29b05e361fa9273a9402eb15f4d81accaf60b2488a9762d423e
- SSDEEP
  
  12288:CaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgd:TAEENIq8XwyVPQclDq/+WnpsS
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan