Overview

overview

10

Static

static

3

3ec4df10da...84.exe

windows7-x64

10

3ec4df10da...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ec4df10da07b3505f3d0cc43c30f37ca9d5e8e2d8349cc5324402ce8e5f4784

  • Size

    659KB

  • Sample

    250220-2mkqbsxldl

  • MD5

    2767d03d18bb350f7a79727d88ed6055

  • SHA1

    319636dd0a845cca392706ed3668eec3681c99fa

  • SHA256

    3ec4df10da07b3505f3d0cc43c30f37ca9d5e8e2d8349cc5324402ce8e5f4784

  • SHA512

    634e4ae7e2ff933ba40ea69e35332021923ce8c715c1b2d384241f1b8dc8aba894df511cea320545a2a3e6e01437752955bbdcfe8263833976d6054a46744e47

  • SSDEEP

    12288:OQ50wlFE0Zen1Rm8bvfShkU0n4eujffBjmcXI2L2WoH6HCGePcatHl9/+:TWJm8bvK+U0MjRjmcXp2BoCGmn9

Score
10/10
darkcometstdebdiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

STDeb

C2

127.0.0.1:1604

allseeingeyes.ddns.net:1604

allseeingeyes.ddns.net:50

allseeingeyes.ddns.net:51

allseeingeyes.ddns.net:52

allseeingeyes.ddns.net:139
Mutex

DC_MUTEX-BH7SGT0

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    J6rFjSkS7kJD

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    winupdate

rc4.plain

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      3ec4df10da07b3505f3d0cc43c30f37ca9d5e8e2d8349cc5324402ce8e5f4784

    • Size

      659KB

    • MD5

      2767d03d18bb350f7a79727d88ed6055

    • SHA1

      319636dd0a845cca392706ed3668eec3681c99fa

    • SHA256

      3ec4df10da07b3505f3d0cc43c30f37ca9d5e8e2d8349cc5324402ce8e5f4784

    • SHA512

      634e4ae7e2ff933ba40ea69e35332021923ce8c715c1b2d384241f1b8dc8aba894df511cea320545a2a3e6e01437752955bbdcfe8263833976d6054a46744e47

    • SSDEEP

      12288:OQ50wlFE0Zen1Rm8bvfShkU0n4eujffBjmcXI2L2WoH6HCGePcatHl9/+:TWJm8bvK+U0MjRjmcXp2BoCGmn9

    Score
    10/10
    darkcometstdebdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks