darkcomet | 6735eafee2519fb7496c70fdb64e0b337593c03c814287102138ef09620078c6 | Triage

Sharing

General

Target

JaffaCakes118_b687eac81347ccff4ab5feadb797d065
Size

687KB
Sample

250207-nlpq1azqbm
MD5

b687eac81347ccff4ab5feadb797d065
SHA1

b8e214883fba0f86d83fe2a4654d0bd1412e04eb
SHA256

6735eafee2519fb7496c70fdb64e0b337593c03c814287102138ef09620078c6
SHA512

bc722ff50e5c0edc7372e99a3419f5830cfd5b1953fe94cdee306d2a4a356f339e31c2f14a4171d70c127cab73d33896a30efcd898d012ee72793e2859aeffe0
SSDEEP

12288:12qpRtw2UCMV8G6bmO2g3XjOGdWVqkGZF9xeIP1o1mrfYH/GUDUtAEt:12yE2UCMWb9lDOGd0I86SmTeDUtAEt

Score

10^/10

darkcomet crypter defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Extracted

Family

darkcomet

Botnet

Crypter

C2

phishingfors.no-ip.org:1604

Mutex

DC_MUTEX-KHT0FWK

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
A/AB#SHYk5E2
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

rc4.plain

Targets

- Target
  
  JaffaCakes118_b687eac81347ccff4ab5feadb797d065
- Size
  
  687KB
- MD5
  
  b687eac81347ccff4ab5feadb797d065
- SHA1
  
  b8e214883fba0f86d83fe2a4654d0bd1412e04eb
- SHA256
  
  6735eafee2519fb7496c70fdb64e0b337593c03c814287102138ef09620078c6
- SHA512
  
  bc722ff50e5c0edc7372e99a3419f5830cfd5b1953fe94cdee306d2a4a356f339e31c2f14a4171d70c127cab73d33896a30efcd898d012ee72793e2859aeffe0
- SSDEEP
  
  12288:12qpRtw2UCMV8G6bmO2g3XjOGdWVqkGZF9xeIP1o1mrfYH/GUDUtAEt:12yE2UCMWb9lDOGd0I86SmTeDUtAEt
Score

10^/10

darkcomet crypter defense_evasion discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometcrypterdefense_evasiondiscoverypersistencerattrojan

behavioral2

darkcometcrypterdefense_evasiondiscoverypersistencerattrojan