darkcomet | 9ec6960f5bd3b7fb89bb21e43520cd348222918a69023f37e248a0732a46c587 | Triage

Sharing

General

Target

JaffaCakes118_5451c99792e6a12b34a84474f258575a
Size

232KB
Sample

250101-n7pm5awqgj
MD5

5451c99792e6a12b34a84474f258575a
SHA1

eb5a41dc732107377a8aefea572777d06c5e7b2c
SHA256

9ec6960f5bd3b7fb89bb21e43520cd348222918a69023f37e248a0732a46c587
SHA512

a09d777bf5d38312cbba3925db207ee98811f0e9d66d9ab01d5b3530c43fefc4b8d8a030d38194cf86fa18ce8c2b30345c9989bdad992380c3d242a12c9a4683
SSDEEP

3072:NeYWY2T3N1FrWyIifIJKq7UCZ6STpiSHFV4un13C+qXYRVXLdZb/WnyablH:ZLyNTT1fI+YB9xOun9Chcxx8yab

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_5451c99792e6a12b34a84474f258575a
- Size
  
  232KB
- MD5
  
  5451c99792e6a12b34a84474f258575a
- SHA1
  
  eb5a41dc732107377a8aefea572777d06c5e7b2c
- SHA256
  
  9ec6960f5bd3b7fb89bb21e43520cd348222918a69023f37e248a0732a46c587
- SHA512
  
  a09d777bf5d38312cbba3925db207ee98811f0e9d66d9ab01d5b3530c43fefc4b8d8a030d38194cf86fa18ce8c2b30345c9989bdad992380c3d242a12c9a4683
- SSDEEP
  
  3072:NeYWY2T3N1FrWyIifIJKq7UCZ6STpiSHFV4un13C+qXYRVXLdZb/WnyablH:ZLyNTT1fI+YB9xOun9Chcxx8yab
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan