darkcomet | f6ccbca4b85a798e2f139539019ad7f5e498c9545c5b6456c6cbf5898a5ac5d6 | Triage

Sharing

General

Target

9fe863122619a4854e49c44024bd70ff_JaffaCakes118
Size

748KB
Sample

241126-ffx67avpdx
MD5

9fe863122619a4854e49c44024bd70ff
SHA1

8d329725d1e5d2b428156252a1ce5e40d349d03c
SHA256

f6ccbca4b85a798e2f139539019ad7f5e498c9545c5b6456c6cbf5898a5ac5d6
SHA512

1ab58a6da4752e9234511a527a9e522ba5d2008544e8d475a111cb7a238f5285fe83dc54e1735d28ae86192109c00c8f43c952f55d94b51b77e0d749f874f9b0
SSDEEP

12288:FRYPaes4XBj3zvYJV1p+MKRLehXrI4aip5QUl8SQGnuutvzeiJzLvLkGY6tEaWYm:gaKxb0JV1pGehXRfpzHyyJvV+TYm

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  9fe863122619a4854e49c44024bd70ff_JaffaCakes118
- Size
  
  748KB
- MD5
  
  9fe863122619a4854e49c44024bd70ff
- SHA1
  
  8d329725d1e5d2b428156252a1ce5e40d349d03c
- SHA256
  
  f6ccbca4b85a798e2f139539019ad7f5e498c9545c5b6456c6cbf5898a5ac5d6
- SHA512
  
  1ab58a6da4752e9234511a527a9e522ba5d2008544e8d475a111cb7a238f5285fe83dc54e1735d28ae86192109c00c8f43c952f55d94b51b77e0d749f874f9b0
- SSDEEP
  
  12288:FRYPaes4XBj3zvYJV1p+MKRLehXrI4aip5QUl8SQGnuutvzeiJzLvLkGY6tEaWYm:gaKxb0JV1pGehXRfpzHyyJvV+TYm
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan