Overview

overview

10

Static

static

10

1a0494c255...18.exe

windows7-x64

10

1a0494c255...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a0494c25535b8afcec320508785e0c7_JaffaCakes118

  • Size

    646KB

  • Sample

    240628-n2fg9sxhqf

  • MD5

    1a0494c25535b8afcec320508785e0c7

  • SHA1

    681baf728c857e615ffe9cbe08f1d1c288ccdf3a

  • SHA256

    0e8b4487dc2329956cfba875d3db8166136c0e8faedab0735f1af63f724ddfda

  • SHA512

    11516919e264f6b06fbedc1aada85cf3ca823c2b99613e31c479c182f6e9db7a2a73db986a744984114a78459c8a0c1be254929e3074e8e6ffbd2fa52a2426f9

  • SSDEEP

    12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixI:5UKoN0bUxgGa/pfBHDb+y1HgZC

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      1a0494c25535b8afcec320508785e0c7_JaffaCakes118

    • Size

      646KB

    • MD5

      1a0494c25535b8afcec320508785e0c7

    • SHA1

      681baf728c857e615ffe9cbe08f1d1c288ccdf3a

    • SHA256

      0e8b4487dc2329956cfba875d3db8166136c0e8faedab0735f1af63f724ddfda

    • SHA512

      11516919e264f6b06fbedc1aada85cf3ca823c2b99613e31c479c182f6e9db7a2a73db986a744984114a78459c8a0c1be254929e3074e8e6ffbd2fa52a2426f9

    • SSDEEP

      12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixI:5UKoN0bUxgGa/pfBHDb+y1HgZC

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks