darkcomet | 5d92d079221cc27559e699db67b12bd0ecf9425c722340e1c8717644c5f1cf24 | Triage

Sharing

General

Target

JaffaCakes118_9e503285b627ea4c741a091f08c9bd0a
Size

1003KB
Sample

250205-lqpwfssmeq
MD5

9e503285b627ea4c741a091f08c9bd0a
SHA1

bc0580d85ecb1c1f164d61873f02c0b6806fae77
SHA256

5d92d079221cc27559e699db67b12bd0ecf9425c722340e1c8717644c5f1cf24
SHA512

164c8e3185d20a39335f8afaf47ef9955d57f46c856221096c185fd9cee3e18959c1e19057005b8b29675055167441d99142a108a707aa9d0351f8e7ff9f47c2
SSDEEP

24576:Fjo0HWLwdVWFkFIfP926yG0RL0ZzK1xdg6:FjoeWs+bd2IRK1xdg

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_9e503285b627ea4c741a091f08c9bd0a
- Size
  
  1003KB
- MD5
  
  9e503285b627ea4c741a091f08c9bd0a
- SHA1
  
  bc0580d85ecb1c1f164d61873f02c0b6806fae77
- SHA256
  
  5d92d079221cc27559e699db67b12bd0ecf9425c722340e1c8717644c5f1cf24
- SHA512
  
  164c8e3185d20a39335f8afaf47ef9955d57f46c856221096c185fd9cee3e18959c1e19057005b8b29675055167441d99142a108a707aa9d0351f8e7ff9f47c2
- SSDEEP
  
  24576:Fjo0HWLwdVWFkFIfP926yG0RL0ZzK1xdg6:FjoeWs+bd2IRK1xdg
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan