Overview

overview

10

Static

static

10

9cb97da1fd...2N.exe

windows7-x64

10

9cb97da1fd...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cb97da1fda37bf2ef524d5c4d3d7f4a3e688bb5ccc42d4216aab8767de7e1b2N

  • Size

    690KB

  • Sample

    241023-ernapazfne

  • MD5

    521c3561809cde12297d9d94507f1270

  • SHA1

    94527050dc3d47fe33e2b61213c42b7d8df36920

  • SHA256

    9cb97da1fda37bf2ef524d5c4d3d7f4a3e688bb5ccc42d4216aab8767de7e1b2

  • SHA512

    7e357e77c8d0ab16af73fda2cc6c7ea523a1c399a68f65ddf5903c43a5e8bbf9157038da017d04ac26e2a48354a39cdddd7b1d96e331b29fb650ad4c150ba937

  • SSDEEP

    12288:cOANXryu1S69QwWBIlVi4o858nFBKgmvtOwUATgDQ4vl:FANOCS6qwWB0V5o8mnqvtrdgDQ4

Score
10/10
darkcometdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      9cb97da1fda37bf2ef524d5c4d3d7f4a3e688bb5ccc42d4216aab8767de7e1b2N

    • Size

      690KB

    • MD5

      521c3561809cde12297d9d94507f1270

    • SHA1

      94527050dc3d47fe33e2b61213c42b7d8df36920

    • SHA256

      9cb97da1fda37bf2ef524d5c4d3d7f4a3e688bb5ccc42d4216aab8767de7e1b2

    • SHA512

      7e357e77c8d0ab16af73fda2cc6c7ea523a1c399a68f65ddf5903c43a5e8bbf9157038da017d04ac26e2a48354a39cdddd7b1d96e331b29fb650ad4c150ba937

    • SSDEEP

      12288:cOANXryu1S69QwWBIlVi4o858nFBKgmvtOwUATgDQ4vl:FANOCS6qwWB0V5o8mnqvtrdgDQ4

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks