darkcomet | 628ff193256507f8c7ee292dbb844eb1af73dd40370225d07f91823f9b7a80bf | Triage

Sharing

General

Target

JaffaCakes118_423e2a21a50500e685a172c24ec0f433
Size

811KB
Sample

250101-bvjvwsyrhv
MD5

423e2a21a50500e685a172c24ec0f433
SHA1

f36cedcbc57957e9bc238e538b9057d4df66eaa7
SHA256

628ff193256507f8c7ee292dbb844eb1af73dd40370225d07f91823f9b7a80bf
SHA512

f33303b6db5cf4786debea19d7277e10f3067392989abf0f617ce79147c3a46244f710f9945ca640f4a092b49ba574280e55c7ecf02c8c76c7a28a3eb7668785
SSDEEP

24576:lAEENIq8XwyVPQclDq/+WnpsSdD0QZh9uL:lAEsw722Wn8L

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_423e2a21a50500e685a172c24ec0f433
- Size
  
  811KB
- MD5
  
  423e2a21a50500e685a172c24ec0f433
- SHA1
  
  f36cedcbc57957e9bc238e538b9057d4df66eaa7
- SHA256
  
  628ff193256507f8c7ee292dbb844eb1af73dd40370225d07f91823f9b7a80bf
- SHA512
  
  f33303b6db5cf4786debea19d7277e10f3067392989abf0f617ce79147c3a46244f710f9945ca640f4a092b49ba574280e55c7ecf02c8c76c7a28a3eb7668785
- SSDEEP
  
  24576:lAEENIq8XwyVPQclDq/+WnpsSdD0QZh9uL:lAEsw722Wn8L
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan