Overview

overview

10

Static

static

7

f461b17cf8...c6.exe

windows7-x64

10

f461b17cf8...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.zip

  • Size

    5.3MB

  • Sample

    241104-veytnatbra

  • MD5

    35ecb6540debefd7ed3e02effbc78e43

  • SHA1

    408269fe3c8dd131be0bec12f180e9203f8490b6

  • SHA256

    50345c9206d2abdbd6ba42f019456e51d9b1d1507e794c4ffc27d561ef3a5b83

  • SHA512

    3b40e69cec2f2bdf16ffb7d77267b84b4b6f83b6d9af7508885ad1b11c5601a227aa8e05eafc1a033c8a2d91414a058e0bc2cfb7a1a2c0a2a85248a2c6542c38

  • SSDEEP

    98304:sU3qA9NjjqoW26UDeF8CCulok9TSr75vO67hSY3yh0TnzhI5Rv5civ:QAf6l2raFvCGokFSr75WchBiGLzhAB5D

Score
10/10
darkcometdiscoveryevasionpersistencerattrojanvmprotect

Malware Config

Targets

    • Target

      f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe

    • Size

      5.4MB

    • MD5

      616fd2b3429b816fc7ebc62d103cc995

    • SHA1

      5a202f24dda9c7b9407b1bc41c27a84c29ea964f

    • SHA256

      f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6

    • SHA512

      a0c1a065d6d6b18127c92597baccbcd4fd2136eee4462182899a928c163a2adad065ceabd6a12bf369a8e5ceafb318c29782100ebfc3e63e014602b7253d1bc2

    • SSDEEP

      98304:9uv8pxJvkLXr8+VOOrjL6eRhzvBG40st9Rl0E4dV0Q89XbrnH:9dY4+QOrjpRhzBL0K9H05dCQwH

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojanvmprotect

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks