darkcomet | bcb2babada75a2347334673af4ab2f6af8cf8f38a0bdf278d0c43fd0dd80e05b | Triage

Sharing

General

Target

7396739e8713e3e3e6f8917a9299c962_JaffaCakes118
Size

265KB
Sample

241024-n1mvyszfpk
MD5

7396739e8713e3e3e6f8917a9299c962
SHA1

ac141e09e479a5df8c78c56e2651f7b76e78c89e
SHA256

bcb2babada75a2347334673af4ab2f6af8cf8f38a0bdf278d0c43fd0dd80e05b
SHA512

1543c0b1ce4e3967b01c1ec00967f0a6d60a37737c310d1290a6963d088be99bea06d5a9004143ab839c22b789898c082623f2cbc69ed8d2d123de2d18dd7802
SSDEEP

6144:Td2d1hhrmXyrwlUdfcODhDg9MFagC47BOUUbJK0MMg:Tcd1hlwEWMFaV44dRg

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  7396739e8713e3e3e6f8917a9299c962_JaffaCakes118
- Size
  
  265KB
- MD5
  
  7396739e8713e3e3e6f8917a9299c962
- SHA1
  
  ac141e09e479a5df8c78c56e2651f7b76e78c89e
- SHA256
  
  bcb2babada75a2347334673af4ab2f6af8cf8f38a0bdf278d0c43fd0dd80e05b
- SHA512
  
  1543c0b1ce4e3967b01c1ec00967f0a6d60a37737c310d1290a6963d088be99bea06d5a9004143ab839c22b789898c082623f2cbc69ed8d2d123de2d18dd7802
- SSDEEP
  
  6144:Td2d1hhrmXyrwlUdfcODhDg9MFagC47BOUUbJK0MMg:Tcd1hlwEWMFaV44dRg
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan