darkcomet | fe4852e8283e20665efc4d6944e3af160abafadb39f70b55b9653efa44fbc772 | Triage

Sharing

General

Target

AzoteLoader_V4.exe
Size

659KB
Sample

250124-yfezqavmcs
MD5

21480585e472fa8a43e37a1c2bcd00f9
SHA1

76ac8ac783ece9f1e46b709b314fba6dae4a84da
SHA256

fe4852e8283e20665efc4d6944e3af160abafadb39f70b55b9653efa44fbc772
SHA512

dca0413b3ae07cd3a057aa9e7b18f46d32fc31be2aedf6705d5cbd3a731d2c1a6899d98f917c6d8ce08630a026537a8e735de0327e6990b48e966a2da2e78853
SSDEEP

12288:29HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hL:SZ1xuVVjfFoynPaVBUR8f+kN10EBl

Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

SupHub-59247.portmap.host:59247

Mutex

DC_MUTEX-AHSQBT4

Attributes

InstallPath
MSDCSC\WindowsUpdater.exe
gencode
7aNjo4Mio4bc
install
true
offline_keylogger
true
persistence
true
reg_key
MicrosoftUpdate

Targets

- Target
  
  AzoteLoader_V4.exe
- Size
  
  659KB
- MD5
  
  21480585e472fa8a43e37a1c2bcd00f9
- SHA1
  
  76ac8ac783ece9f1e46b709b314fba6dae4a84da
- SHA256
  
  fe4852e8283e20665efc4d6944e3af160abafadb39f70b55b9653efa44fbc772
- SHA512
  
  dca0413b3ae07cd3a057aa9e7b18f46d32fc31be2aedf6705d5cbd3a731d2c1a6899d98f917c6d8ce08630a026537a8e735de0327e6990b48e966a2da2e78853
- SSDEEP
  
  12288:29HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hL:SZ1xuVVjfFoynPaVBUR8f+kN10EBl
Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

guest16darkcomet

behavioral1

darkcometguest16defense_evasiondiscoverypersistencerattrojan