Subject: DarkComet RAT – Phishing
Tactics: TA0001 Initial Access
Technique: T1566.001 Phishing: Spearphishing Attachment
Procedure:
The attacker sent a spearphishing email containing a malicious Microsoft Word document (.doc) as an attachment. This document exploits a vulnerability (CVE-2012-0158) to execute embedded malicious code, ultimately leading to the download and execution of the DarkComet RAT payload.
Vulnerability: EAV0004 When adversaries use phishing emails to gain access to victim systems, they have no control over where a malicious attachment is detonated from, or where a link is clicked.
Engagement Opportunity:
Deploy a honeypot designed to mimic a vulnerable workstation. This honeypot can be configured to ‘take the bait’ in the phishing email, allowing us to capture the malicious attachment, analyze the exploit, and observe the DarkComet RAT’s behavior in a controlled environment. This will provide valuable intelligence on the attacker’s TTPs and potentially reveal their infrastructure.
Threat Actor: Unknown (Potentially a Script Kiddie or Low-Sophistication Cybercriminal)
Threat Objective:
Likely unauthorized access, potential data theft, and possible system compromise for botnet recruitment or further malicious activities.
Deception Opportunity:
In addition to the honeypot, we can seed decoy documents within the honeypot environment. These documents can contain fake credentials or seemingly valuable data to lure the attacker into revealing their exfiltration methods and ultimate objectives.
Sensor Data Placement: Application
Observable Level: Core to Adversary-Brought Tool
Scoring Rationale:
While the exploit (CVE-2012-0158) might be relatively common, the specific weaponized document and the DarkComet RAT configuration are likely unique to this attacker or their group. Analyzing these provides valuable insights into their capabilities and intent.
Link to Report: https://any.run/malware-trends/darkcomet
Link to Report II.: https://app.any.run/tasks/7f5f43ce-f9db-405a-8e4c-17e7bd3bfc19/?utm_source=anyrunblog&utm_medium=article&utm_campaign=darkcomet_analysis&utm_term=231024&utm_content=linktoservice
Additional Comments:
Possible elements:
MSG (Pseudocode):