darkcomet | 0299f0c9537c0a9c3415221f2939b9d3f964090d9f02e80c1bb3916cfeb346c3 | Triage

Submit
Reports

Overview

overview

Static

static

eaa3e99c14...18.exe

windows7-x64

eaa3e99c14...18.exe

windows10-2004-x64

Sharing

General

Target

eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118
Size

374KB
Sample

241213-jw2fbsvjdr
MD5

eaa3e99c14f2a6c77f1991ba4132b1f1
SHA1

1bb5481c627e599609c1b34e97ba68355de2ba0e
SHA256

0299f0c9537c0a9c3415221f2939b9d3f964090d9f02e80c1bb3916cfeb346c3
SHA512

b2cf4c16d8d11c3760c0b9c09bf8cc14c475011e91dbac469fb659591182a1f584020e27eb690d215cea6ecfce17774644c819f39d4083564eda2a492dd7b8a4
SSDEEP

6144:kzNxMMVANb6ES5Kg3PIuYkk94yNcO43SiIDxfB7GTndEgVpRlrsI4:2xkOHPVg4ydeRI1V8R5sI4

Score

10^/10

darkcomet discovery evasion persistence rat trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe

Resource

win7-20240903-en

darkcomet discovery evasion persistence rat trojan upx

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery evasion persistence rat trojan upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118
- Size
  
  374KB
- MD5
  
  eaa3e99c14f2a6c77f1991ba4132b1f1
- SHA1
  
  1bb5481c627e599609c1b34e97ba68355de2ba0e
- SHA256
  
  0299f0c9537c0a9c3415221f2939b9d3f964090d9f02e80c1bb3916cfeb346c3
- SHA512
  
  b2cf4c16d8d11c3760c0b9c09bf8cc14c475011e91dbac469fb659591182a1f584020e27eb690d215cea6ecfce17774644c819f39d4083564eda2a492dd7b8a4
- SSDEEP
  
  6144:kzNxMMVANb6ES5Kg3PIuYkk94yNcO43SiIDxfB7GTndEgVpRlrsI4:2xkOHPVg4ydeRI1V8R5sI4
Score

10^/10

darkcomet discovery evasion persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojanupx

behavioral2

darkcometdiscoveryevasionpersistencerattrojanupx

© 2018-2024

Terms | Privacy