darkcomet | c6fda4c45f1df9cbcc6054256dbe73fd89a332fc8ff8552347c46a6dc364da97 | Triage

Sharing

General

Target

df59496ce9d9eba8bfc447c066650a04_JaffaCakes118
Size

737KB
Sample

241211-btd81stlfp
MD5

df59496ce9d9eba8bfc447c066650a04
SHA1

845003070ae7d41c5770dc7805f9d880ed525f56
SHA256

c6fda4c45f1df9cbcc6054256dbe73fd89a332fc8ff8552347c46a6dc364da97
SHA512

eb39eefadcdb7856c4bd44cc9079c1d84093e4fc6fb3ef94a7438d24b5d3b7eaba6c5b6a8a2c81ca3ea79493e3809d611b76add347b72447935040ddbecf066b
SSDEEP

12288:sJmHQJV+Q9zFIs9i3s7Q6jcIaVCc+ZfSpCzrxXUd42/RhSGnfMPxvCVEwVZCJg:sJm+zOsg3snE4c+ZfSp0rxXO42pAcK5e

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Targets

- Target
  
  df59496ce9d9eba8bfc447c066650a04_JaffaCakes118
- Size
  
  737KB
- MD5
  
  df59496ce9d9eba8bfc447c066650a04
- SHA1
  
  845003070ae7d41c5770dc7805f9d880ed525f56
- SHA256
  
  c6fda4c45f1df9cbcc6054256dbe73fd89a332fc8ff8552347c46a6dc364da97
- SHA512
  
  eb39eefadcdb7856c4bd44cc9079c1d84093e4fc6fb3ef94a7438d24b5d3b7eaba6c5b6a8a2c81ca3ea79493e3809d611b76add347b72447935040ddbecf066b
- SSDEEP
  
  12288:sJmHQJV+Q9zFIs9i3s7Q6jcIaVCc+ZfSpCzrxXUd42/RhSGnfMPxvCVEwVZCJg:sJm+zOsg3snE4c+ZfSp0rxXO42pAcK5e
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan