darkcomet | 1ffbcaf8e8ec34bcdc93e6f99f05c741a706f43eb114a213d56a9152f0f0d520 | Triage

Sharing

General

Target

test.exe
Size

659KB
Sample

250225-sg8erssjs3
MD5

cdfa77013d745c35bfb64d5a2578bcb0
SHA1

96813fa48898cafa6ef8bb6a086cb72fbf4d78ff
SHA256

1ffbcaf8e8ec34bcdc93e6f99f05c741a706f43eb114a213d56a9152f0f0d520
SHA512

cf4a9df12b25c5d7b63a6083c00e74605dcfc9be2b44cf64498c7609f70df3b39706e93e3f964c1391c8a1aa5cc07252350d194585b89cd7c30cc79567baa86f
SSDEEP

12288:u9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hj:6Z1xuVVjfFoynPaVBUR8f+kN10EB1

Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

bendover1242.ddns.net:5500

Mutex

DC_MUTEX-74EE7JV

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
PaCm1ukBMcN9
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

rc4.plain

Targets

- Target
  
  test.exe
- Size
  
  659KB
- MD5
  
  cdfa77013d745c35bfb64d5a2578bcb0
- SHA1
  
  96813fa48898cafa6ef8bb6a086cb72fbf4d78ff
- SHA256
  
  1ffbcaf8e8ec34bcdc93e6f99f05c741a706f43eb114a213d56a9152f0f0d520
- SHA512
  
  cf4a9df12b25c5d7b63a6083c00e74605dcfc9be2b44cf64498c7609f70df3b39706e93e3f964c1391c8a1aa5cc07252350d194585b89cd7c30cc79567baa86f
- SSDEEP
  
  12288:u9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hj:6Z1xuVVjfFoynPaVBUR8f+kN10EB1
Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

guest16darkcomet

behavioral1

darkcometguest16defense_evasiondiscoverypersistencerattrojan