darkcomet

Target
251028-vkjxpaxrap_pw_infected.zip
Size 45.4MB
Sample251122-vb6ebsbk51
SHA256 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445
MD5 1fcf428d37f7ae7b425fba9668098b14
SHA1 34f4131bd058cca977147eaf957464837b5d7ada
SHA512 3d96349fd73e3ba35060419d8401df78550d21e203a6b7e30a10345cc0622342a6ba64dc9a12cf7a94f58c9c649fed27870f0cdafee302516d41f89cc2691518
SSDEEP 786432:a5sC4IUx4TDGguUu80jqUg69lYBjKYRDm6kWB/Q+7uOZ+c1WfMQVZr/EapS621oP:a5tHHYz80jLJYIYsKXT/1/Qj5wX4
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

bibl1234.ddns.net:1604

Mutex

DC_MUTEX-QKPH38W

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
2PaBrGj3TwxK
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

rc4.plain

Extracted

Family

smokeloader

Version

2018

http://aviatorssm.bit/
http://anotherblock.bit/

rc4.i32

Targets

- Target
  251028-vkjxpaxrap_pw_infected.zip
- Size 45.4MB
- SHA256 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445
- MD5 1fcf428d37f7ae7b425fba9668098b14
- SHA1 34f4131bd058cca977147eaf957464837b5d7ada
- SHA512 3d96349fd73e3ba35060419d8401df78550d21e203a6b7e30a10345cc0622342a6ba64dc9a12cf7a94f58c9c649fed27870f0cdafee302516d41f89cc2691518
- SSDEEP 786432:a5sC4IUx4TDGguUu80jqUg69lYBjKYRDm6kWB/Q+7uOZ+c1WfMQVZr/EapS621oP:a5tHHYz80jLJYIYsKXT/1/Qj5wX4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Malware-1-master.zip
- Size 45.4MB
- SHA256 2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c
- MD5 ef37386fefe6fbbf646805a591add083
- SHA1 1abfc73d9a379c796036de72e5f7961b4295bf5e
- SHA512 112cccdada7554db108f3fd469e72fc0568aadbcad33b75a2046018827c5542d5fdcb6b454eb7bb0f58a6ea00e65bcd503a807222e1f21cc9a0f087c89453d3e
- SSDEEP 786432:8hXFC0opkN2sA1VYXb1ZfLKvrXpXyNoqpkHuMBWn3GhUclPgJ26GEa5+VX:+FnQCXb1ZzsyXpKdBEGeQP2Vj++p
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  Malware-1-master/Blocked-v1.0.ipa
- Size 1.1MB
- SHA256 19c538fbb52c15ed9c739c2f45e5d78e432a916db0218f77c7297d96d72e709d
- MD5 bdf0fcbfaf2d9a0d788a3b6ace7c6b42
- SHA1 02b6be369997d4d0ddc7ea7cf9d0e0ad02470b5f
- SHA512 0c271a0df77f86fa6ecf483389f34ab1a95109dda468a84a150058e4e363bcc5021f538671a22fbca85516fc07815cfaf3027715e720a6e760061972ef172c47
- SSDEEP 24576:KxaqV2aFXljSo9osEv4gfyyYAcPEec5/KqnIqi9Yr21LT1qUDKIqSRPFgJIW:6zN9onpmB+xQLZ7DRFQIW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Malware-1-master/Download.exe
- Size 247KB
- SHA256 de2274da8cf00dfc6e6e52db43f82210a1fb7fd30016ebdc81347fb2d1f248fa
- MD5 6a97f4f16e7879967a5c02d143d0bd46
- SHA1 0898ccf65770813f69bf339462a05a8c6e17be69
- SHA512 0bc14103518a2e234f4e3f4ddc46e91a1ed21c2885fd4eb27d3cf8cd088e4fa4fffcc221ddb404f52794c57d6693b2ce080e797bf33f2322490030e0fce0ac27
- SSDEEP 3072:ZV3bDzHY2weWeFoyUWfMRBsfpVZynzK4ChhO2IGmXf3Ur3CvZJnodCKJYsUH+Iun:ZBbDzHY0UsfPwUIvOd1
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  Malware-1-master/GunMayhem1unblocked.swf
- Size 5.7MB
- SHA256 f85f970882bc6667749e219a13736c9ec21b8c9c24b8b72bfe272f33be4248f1
- MD5 bbbd8262dda1516961e2b9d936e20583
- SHA1 2dc9e8ec267747d75bf98779b95e606f64357944
- SHA512 047d4a3e730543180922e73aa392c78da9f14117589bb787cec97e171c42dc8111647541c495bd7844a650ad580e131bccc6a76da55acc51400306a3084eff0f
- SSDEEP 98304:LMcKfaqSDrXuv/jEC39YRofE8X0QC6x2aAN3+FDNYsCPnXLH+bB7kpV4r5N5RUBa:ocnre3YC31fpu6x2aSqDNYpXL+dwV4X/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  Malware-1-master/Illuminati.exe
- Size 1.1MB
- SHA256 f99e4c9a4dd14d402b16e36988b72f3fe7f34b42157f756dbd14b39c70059336
- MD5 087b2505ac41831c753cf7d1e660c42c
- SHA1 dcae226923e062291f48de4d3416d38387815c67
- SHA512 10d5f6f7c9f1df66a7afd3dcd2e70288d89bb75a2f6fffa3621b4a4192c40b290eb7c76392b0b282d80925b81d2271c3d1e96a4f406d1f1c0d069a5f6f96c086
- SSDEEP 24576:qqvM7STjLT5MSLMDPS2X0xCyj8pk3tgqdtKkkoMJJck:VwMfTvcS2kjPgUGfJ
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  Malware-1-master/Software.exe
- Size 1.6MB
- SHA256 e7f04e85236f0caafe518bd96369313021969077dba1c4a6d42e694498dab04f
- MD5 db056b8fa628b67e11bd626192939d6b
- SHA1 248ca50f39de6b6180265d19fb6eedc68bf25afc
- SHA512 bca1856b4bb8342c0f6d5ee19edcb420c70e6b272f087d3f8f73daa00842fa00037840a5eb5655e1445af8d578d304874323b2889f75b27136df9366df596336
- SSDEEP 24576:ytb20pkaCqT5TBWgNQ7ayEYyM63uUOyok0ceJZwd/w9mML9eu4MaMUp46A:/Vg5tQ7ayExZO9k0waPLR4Ma25
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery imminent spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Imminent family
  imminent
- Drops startup file
- Suspicious use of SetThreadContext
behavioral13 behavioral14
- Target
  Malware-1-master/apache.exe
- Size 252KB
- SHA256 1117f585985ca4ddd03695876522f80951c919cb41db5854f013923f62285c09
- MD5 8e747a4c115ac090e54dfa899c287129
- SHA1 a1c523ad0a2fa1b533fb752a25aa48ff1cd4e1e3
- SHA512 049fae2cccf4e1afc79d9e72e016f27d7714ad8b747c28ec3ad520bc25ff319f12aced97d16dbbe863aaab11514a9e90477656983fd67939c0e6d2ddb93558b3
- SSDEEP 6144:ZcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQc:ZcWkbgTYWnYnt/IDYhPn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guest16 defense_evasion discovery darkcomet persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  Malware-1-master/butterflyondesktop.exe
- Size 2.8MB
- SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
- MD5 1535aa21451192109b86be9bcc7c4345
- SHA1 1af211c686c4d4bf0239ed6620358a19691cf88c
- SHA512 1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
- SSDEEP 49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery installer persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral17 behavioral18
- Target
  Malware-1-master/eternalblue.exe
- Size 886KB
- SHA256 7f5f447fe870449a8245e7abc19b9f4071095e02813d5f42c622add56da15b8b
- MD5 981aaac4782bb076aa737901910f2556
- SHA1 a552a4dac03b584cbb7d461fd48b01ddaa85af5d
- SHA512 334d096f72d46adc522f21834d116968a7cb5f05dc21c60e094ac4ccff69412a2c108aeb5c54861ac717ebf884c632edd0291a3d832e4ab7dcc7903e7f965934
- SSDEEP 12288:96fny4wDTzvE/XICULcJ48j406qbgg6RaAD9bSoGGHgm3Ihr6k:96fny4wbkHJ4I40vggPWSoGWv3c
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  Malware-1-master/o.exe
- Size 110KB
- SHA256 47b306c80cf27a773d252757397fe9ec0a9571666044276166ede5b5958489ff
- MD5 73f0230c31eaca0f8cb20c88b4bd6599
- SHA1 79d4ceaa753437e14f4baae45c4675a302f4d383
- SHA512 afb59f13e5485e6815ac38a82b68cdf93bc2a8b01f818e88570fd8a50a6debafa2dcdb61ca4812700a0a223b44f60466333114375075b2c76e7a59c73a72bf01
- SSDEEP 768:YY+RphoNSQhwS2BGmhn6MxRhUeADEe+NBgNK:XkY+pzn6shAgeqB
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Malware-1-master/qOA7iZJcoB8.exe
- Size 400KB
- SHA256 6b111be3c180de78849b4f1c2d39ee0045695e22d339b50879a769351b1e6b31
- MD5 7a58e7f8cd91b372af614ffe5db58eca
- SHA1 8e341ffcfcb4b60b93700996b037c35f0221ec39
- SHA512 c89d62ddcc79d0e1a42dc090b3a149483e91f61c9aa9aaa489535dc32462d55d6accc2f55a255c42579c89a78afdd62f271dbcb4aab6c075b8cb70f6a143b5bf
- SSDEEP 3072:bQgo+/qo6aiN3HKwkRF9kl+BHpQB8ID0msCJhp4Swm5WXDtVL3d0:2+/qo6f9kRFyl+BJM8ID0pCr/wm5S
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

banker discovery emotet trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
behavioral23 behavioral24
- Target
  Malware-1-master/readme.md
- Size 154B
- SHA256 778853b036941d503d6f279777eeb14130c24c318e5c2ea2c6eadabca331693b
- MD5 663c882a0d419faf6e2f5248475af539
- SHA1 16aa09ad953d6c1f9b119db699518cefac07a937
- SHA512 97a0db4705846772765d497f59200dc47f96c167aba886e61292eaa19d2c798923022572a1da755a926ebe4832530e870714f31281329d0f76833569415f111e
- MD5 SHA1 SHA512
Score

3^/10
behavioral25 behavioral26
- Target
  Malware-1-master/rig.exe
- Size 2.4MB
- SHA256 ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f
- MD5 570a9cc9fd20159e92707abe69676299
- SHA1 864cb610c0c80cf8ff00fd4aaae9b05fa63fd990
- SHA512 ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92
- SSDEEP 49152:BfOqHErn3OFIJDOmxFVIdtKfBDhqGDZdB4hYk/0AK0uOkJA79OB8OITieIr:fcne+9Omb+dtKfBD3rZOkJA79OBkbI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery privateloader xmrig loader miner vmprotect
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Privateloader family
  privateloader
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral27 behavioral28
- Target
  Malware-1-master/sysm.exe
- Size 234KB
- SHA256 6cccd484309dec754cbed83d20747928b7e2e0b81afc2222135c4fc08bfc9709
- MD5 11af285c2cc20603ef79889bbf6c6ac3
- SHA1 35433420a2468a0b90fb36eae99c7e16865aabb3
- SHA512 57d2cc77b8b742b9d0e490bd2433171c82fb86580145a7ec026051342bee8e2d291d5de83e6438e1479a4cc46136fcc6e6695c748f0653171b1d3dc3228c595d
- SSDEEP 1536:DyXJDBO9C0h7mhLN2+kOngP5Q8gCec2X4LBvm8BSqxfbkPuWmZ0jOoHHSEPUoHPP:DyXyfp9P5BhLBvFXNkGH0jOoTHKFa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

backdoor discovery smokeloader trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral29 behavioral30
- Target
  Malware-1-master/wannakey-master.zip
- Size 2.6MB
- SHA256 941eb0ade566d9b13faafcbc9b94961fede92f01d28bec4e3b70d11f74d0549d
- MD5 3e124e1aef07a9ec3085bcf8c6234e1c
- SHA1 1765ae5f7097d18f63a4f7dfcebdf78617bf6eb0
- SHA512 20892d03aaab0ac22c653be27af9be1afadc1bd3b4b746683a5c381805eed20f3ec00c90b335c19337777549d9f4d296d8c2af03bc54824cd10420822404d78f
- SSDEEP 49152:G4lcggNwl3edhRpi7RhXt2oYe+8Yk5Ddk6KGuKcC7LXYrQb6sw4J6YR6g:G4kdCRvce+pk5q6OKtIarY3g
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

UPX packed file

Imminent RAT

Imminent family

Drops startup file

Suspicious use of SetThreadContext

Darkcomet family

Modifies WinLogon for persistence

Modifies firewall policy service

Modifies security service

Windows security bypass

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Sets file to hidden

Checks computer location settings

Executes dropped EXE

Windows security modification

Adds Run key to start application

UPX packed file

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Emotet

Emotet family

PrivateLoader

Privateloader family

Xmrig family

xmrig

XMRig Miner payload

VMProtect packed file

SmokeLoader

Smokeloader family

Maps connected drives based on registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32