darkcomet | ca6adeaaa00617e173a3865d0922f176bc57f2edc753b4a4a4213c6dc6e6b99d | Triage

Sharing

General

Target

71f53dcd12ea8bcfb67a8f6b9051ca6a_JaffaCakes118
Size

900KB
Sample

241024-c24djs1ala
MD5

71f53dcd12ea8bcfb67a8f6b9051ca6a
SHA1

61eaa05adbe3ea7b3f83c04de61626922373f056
SHA256

ca6adeaaa00617e173a3865d0922f176bc57f2edc753b4a4a4213c6dc6e6b99d
SHA512

e75566379a81663396bc0133dd3c4cd7c615a62a308246acd8b17030638e0525bd6c13aac351965a937e7c67a905c8c17ad04746da0dffb98372071183a08b90
SSDEEP

24576:MsViHnFtmkAzo3AXK3E6IXQPttSTJ5p9fOIVEERP60Bu5q6QY:TktAzxqhWMIXp9fOBv0Bunr

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Targets

- Target
  
  71f53dcd12ea8bcfb67a8f6b9051ca6a_JaffaCakes118
- Size
  
  900KB
- MD5
  
  71f53dcd12ea8bcfb67a8f6b9051ca6a
- SHA1
  
  61eaa05adbe3ea7b3f83c04de61626922373f056
- SHA256
  
  ca6adeaaa00617e173a3865d0922f176bc57f2edc753b4a4a4213c6dc6e6b99d
- SHA512
  
  e75566379a81663396bc0133dd3c4cd7c615a62a308246acd8b17030638e0525bd6c13aac351965a937e7c67a905c8c17ad04746da0dffb98372071183a08b90
- SSDEEP
  
  24576:MsViHnFtmkAzo3AXK3E6IXQPttSTJ5p9fOIVEERP60Bu5q6QY:TktAzxqhWMIXp9fOBv0Bunr
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan