Overview

overview

10

Static

static

10

0x00070000...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    msdcsc.exe_pw_infected.zip

  • Size

    350KB

  • Sample

    250413-axbfvsvly4

  • MD5

    790a62a1eafc249a008e91a4b9772ba2

  • SHA1

    520916039031de3c8cb3f50bb9c71322e919f0ba

  • SHA256

    2e99d7064129fe0e23025f4d9d91ed70125564db4a250376d84662853e243185

  • SHA512

    f105069b9d4aab308f47ffd28a24f910202c734468de5609d79312a3ac2f5e56b732625a9c1f1d1a82042dc6d0c15c96d34d857a971ebaf62bb2e84a39461f03

  • SSDEEP

    6144:cpPj2vWkYJuBiFzjercIyYXSB9QASFAiY85kSRtFBF4sVGB8UDGW02l:cpDHQiArcIyAZenEtFBS4GBvDZ02l

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-7X99PTF

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    DNgeskLTppzX

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    System32.dll

rc4.plain

Targets

    • Target

      0x0007000000019273-20

    • Size

      658KB

    • MD5

      3178fcad2d2c2f3c0f4f70aecfb18db7

    • SHA1

      0ecad6522214f9bef4dd8f2f8eb927827bc4971c

    • SHA256

      dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

    • SHA512

      57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

    • SSDEEP

      12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

    Score
    10/10
    darkcometguest16defense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks