Overview

overview

10

Static

static

3

file.0x3fa...0f.exe

windows7-x64

10

file.0x3fa...0f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.0x3fab4450.0x8532f420.ImageSectionObject.svchosts.exed40fae8da0c156fbab0f.img

  • Size

    661KB

  • Sample

    241103-ahql8szalf

  • MD5

    3b56482d3695ab53ff888251a399a298

  • SHA1

    726167c6f628a2a5c91b9a6db49f7f6845a2e028

  • SHA256

    3d507d03c3552c5b4ebe1fd7244f0835331b40518ca3ee4c6b6416826fc83ad4

  • SHA512

    a55564954549d9aaaa74b194c8efa3ea2b19d87fdf75eb1e00d62aa92361663774cb859e10f744c9505677ae939d9a5d894d24923a891ba3774b8a68c9e95a53

  • SSDEEP

    6144:A9oQO8gPOJ9ro8xqX1us6VrpGVvJWScB6LTvXIcIDH45vRc75HzZ5FpgmxQvkNS8:A9HFJ9rJxqX1usonS+LBHARgwkNS5

Score
10/10
darkcometdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      file.0x3fab4450.0x8532f420.ImageSectionObject.svchosts.exed40fae8da0c156fbab0f.img

    • Size

      661KB

    • MD5

      3b56482d3695ab53ff888251a399a298

    • SHA1

      726167c6f628a2a5c91b9a6db49f7f6845a2e028

    • SHA256

      3d507d03c3552c5b4ebe1fd7244f0835331b40518ca3ee4c6b6416826fc83ad4

    • SHA512

      a55564954549d9aaaa74b194c8efa3ea2b19d87fdf75eb1e00d62aa92361663774cb859e10f744c9505677ae939d9a5d894d24923a891ba3774b8a68c9e95a53

    • SSDEEP

      6144:A9oQO8gPOJ9ro8xqX1us6VrpGVvJWScB6LTvXIcIDH45vRc75HzZ5FpgmxQvkNS8:A9HFJ9rJxqX1usonS+LBHARgwkNS5

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks