darkcomet | 44c8432c6320b43a0d6020ead65ad2f218931c7038969702a0ffbfa862b65c61 | Triage

Sharing

General

Target

JaffaCakes118_b24fe9f75a54f69e549e663955428014
Size

718KB
Sample

250207-dnmpbawpds
MD5

b24fe9f75a54f69e549e663955428014
SHA1

903a55a40827c4ec9d171b2acb5e372e42fcccfb
SHA256

44c8432c6320b43a0d6020ead65ad2f218931c7038969702a0ffbfa862b65c61
SHA512

4e73ff762270f379bd21c6aae7e39f1f871390ea34585380b0517507931d425608d36271ce459e5767499cf0df91a6698b866fa1644ad9a088f2695ed3b6d825
SSDEEP

12288:2hcW7U/HYD5q7c/WCMHV2+awfiIHicRN0Dc9loeXDhOWy:2hc2q4VqY+zU+zLKIlLhOR

Score

10^/10

darkcomet hawkeye discovery keylogger persistence rat spyware stealer trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_b24fe9f75a54f69e549e663955428014
- Size
  
  718KB
- MD5
  
  b24fe9f75a54f69e549e663955428014
- SHA1
  
  903a55a40827c4ec9d171b2acb5e372e42fcccfb
- SHA256
  
  44c8432c6320b43a0d6020ead65ad2f218931c7038969702a0ffbfa862b65c61
- SHA512
  
  4e73ff762270f379bd21c6aae7e39f1f871390ea34585380b0517507931d425608d36271ce459e5767499cf0df91a6698b866fa1644ad9a088f2695ed3b6d825
- SSDEEP
  
  12288:2hcW7U/HYD5q7c/WCMHV2+awfiIHicRN0Dc9loeXDhOWy:2hc2q4VqY+zU+zLKIlLhOR
Score

10^/10

darkcomet hawkeye discovery keylogger persistence rat spyware stealer trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcomethawkeyediscoverykeyloggerpersistenceratspywarestealertrojan

behavioral2

darkcomethawkeyediscoverykeyloggerpersistenceratspywarestealertrojan