darkcomet | 0af2f11e9509185513d5ebb4204399908329333704b4e9f59d094876bdda0da3 | Triage

Sharing

General

Target

d96023ce08d8f5d04c03894590a875f6_JaffaCakes118
Size

844KB
Sample

241209-nh1zvszraq
MD5

d96023ce08d8f5d04c03894590a875f6
SHA1

8948692a05894b3fe30ca91ec7f9a072e7e2b9d6
SHA256

0af2f11e9509185513d5ebb4204399908329333704b4e9f59d094876bdda0da3
SHA512

b7ac975c50c363938675419703d91328af68ec6276b970a568b54a83895aeb57403fbc3a9268a36f340c8f2b266001433f41f01241ec4b16db9e46621a213f30
SSDEEP

12288:WZ0mSDkoeHJosIf5+xtQnyRLe6c0IxR0sOZWPfGVxVski6G27akR:ek9gIHkLTOv0sTnuVskF79R

Score

10^/10

darkcomet bootkit discovery persistence rat trojan

Malware Config

Targets

- Target
  
  d96023ce08d8f5d04c03894590a875f6_JaffaCakes118
- Size
  
  844KB
- MD5
  
  d96023ce08d8f5d04c03894590a875f6
- SHA1
  
  8948692a05894b3fe30ca91ec7f9a072e7e2b9d6
- SHA256
  
  0af2f11e9509185513d5ebb4204399908329333704b4e9f59d094876bdda0da3
- SHA512
  
  b7ac975c50c363938675419703d91328af68ec6276b970a568b54a83895aeb57403fbc3a9268a36f340c8f2b266001433f41f01241ec4b16db9e46621a213f30
- SSDEEP
  
  12288:WZ0mSDkoeHJosIf5+xtQnyRLe6c0IxR0sOZWPfGVxVski6G27akR:ek9gIHkLTOv0sTnuVskF79R
Score

10^/10

darkcomet bootkit discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometbootkitdiscoverypersistencerattrojan

behavioral2

darkcometbootkitdiscoverypersistencerattrojan