darkcomet | e201e787e648b66f2871d699d3585b6c32eaa75c1c060d8abf2424d7afe51bc4 | Triage

Submit
Reports

Overview

overview

Static

static

3

720b2ea1f1...18.exe

windows7-x64

720b2ea1f1...18.exe

windows10-2004-x64

Sharing

General

Target

720b2ea1f1308f4b0ab7b33446676d92_JaffaCakes118
Size

664KB
Sample

241024-dhtwfa1fnd
MD5

720b2ea1f1308f4b0ab7b33446676d92
SHA1

913ac9f923bd779a5ece2cea874ff1dbd3288b20
SHA256

e201e787e648b66f2871d699d3585b6c32eaa75c1c060d8abf2424d7afe51bc4
SHA512

c1d217f9d5023f7f03b0456cb51bc979a0bc4b271691ff127752c7aa7c7378eebd5c46dd1cb34e65ad02880f073447255eea4d0d3c2a911d837cb5b592dea8ae
SSDEEP

12288:iaGmHwYguLpRHjSJsizHMwSN01alIdliry0Lk9d2QjVOh3FwF+xfdGr8e21I9rHP:X9Glzuqtd2Q8GM5s

Score

10^/10

darkcomet discovery evasion persistence rat trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

720b2ea1f1308f4b0ab7b33446676d92_JaffaCakes118.exe

Resource

win7-20241010-en

darkcomet discovery evasion persistence rat trojan upx

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

720b2ea1f1308f4b0ab7b33446676d92_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery evasion persistence rat trojan upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  720b2ea1f1308f4b0ab7b33446676d92_JaffaCakes118
- Size
  
  664KB
- MD5
  
  720b2ea1f1308f4b0ab7b33446676d92
- SHA1
  
  913ac9f923bd779a5ece2cea874ff1dbd3288b20
- SHA256
  
  e201e787e648b66f2871d699d3585b6c32eaa75c1c060d8abf2424d7afe51bc4
- SHA512
  
  c1d217f9d5023f7f03b0456cb51bc979a0bc4b271691ff127752c7aa7c7378eebd5c46dd1cb34e65ad02880f073447255eea4d0d3c2a911d837cb5b592dea8ae
- SSDEEP
  
  12288:iaGmHwYguLpRHjSJsizHMwSN01alIdliry0Lk9d2QjVOh3FwF+xfdGr8e21I9rHP:X9Glzuqtd2Q8GM5s
Score

10^/10

darkcomet discovery evasion persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojanupx

behavioral2

darkcometdiscoveryevasionpersistencerattrojanupx

© 2018-2024

Terms | Privacy