darkcomet | 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7
submitted
24/06/2020, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Size 3.1MB
Sample200624-e2tb6ewgvj
SHA256 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e
MD5 48333dea99d9a2a7efe07b871e9e5467
SHA1 85138443ba28a0932305454832e1f809585471ab
SHA512 a7806de37c27afea682b4054c3caf1aafb94f858d7a7467efcf9e795484041391dd17941376e05118b4be726fc06beddedddc3f6fc6d5ab4b31c039fadf44ff0
MD5 SHA1 SHA512

Score

10^/10

darkcomet evasion persistence rat trojan vmprotect

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 2 IoCs

pid	Process
1384	MAIN.EXE
1852	msdcsc.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00050000000131b3-6.dat	vmprotect
behavioral1/files/0x00050000000131b3-8.dat	vmprotect

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	msdcsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	msdcsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Wine	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Wine	msdcsc.exe

Loads dropped DLL 3 IoCs

pid	Process
1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
1852	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
1852	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeSecurityPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeTakeOwnershipPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeLoadDriverPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeSystemProfilePrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeSystemtimePrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeProfSingleProcessPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeIncBasePriorityPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeCreatePagefilePrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeBackupPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeRestorePrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeShutdownPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeDebugPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeSystemEnvironmentPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeChangeNotifyPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeRemoteShutdownPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeUndockPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeManageVolumePrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeImpersonatePrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeCreateGlobalPrivilege	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: 33	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: 34	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: 35	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Token: SeIncreaseQuotaPrivilege	1852	msdcsc.exe
Token: SeSecurityPrivilege	1852	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1852	msdcsc.exe
Token: SeLoadDriverPrivilege	1852	msdcsc.exe
Token: SeSystemProfilePrivilege	1852	msdcsc.exe
Token: SeSystemtimePrivilege	1852	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1852	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1852	msdcsc.exe
Token: SeCreatePagefilePrivilege	1852	msdcsc.exe
Token: SeBackupPrivilege	1852	msdcsc.exe
Token: SeRestorePrivilege	1852	msdcsc.exe
Token: SeShutdownPrivilege	1852	msdcsc.exe
Token: SeDebugPrivilege	1852	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1852	msdcsc.exe
Token: SeChangeNotifyPrivilege	1852	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1852	msdcsc.exe
Token: SeUndockPrivilege	1852	msdcsc.exe
Token: SeManageVolumePrivilege	1852	msdcsc.exe
Token: SeImpersonatePrivilege	1852	msdcsc.exe
Token: SeCreateGlobalPrivilege	1852	msdcsc.exe
Token: 33	1852	msdcsc.exe
Token: 34	1852	msdcsc.exe
Token: 35	1852	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1852	msdcsc.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 760	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	24
PID 1164 wrote to memory of 760	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	24
PID 1164 wrote to memory of 760	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	24
PID 1164 wrote to memory of 760	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	24
PID 1164 wrote to memory of 1116	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	26
PID 1164 wrote to memory of 1116	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	26
PID 1164 wrote to memory of 1116	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	26
PID 1164 wrote to memory of 1116	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	26
PID 760 wrote to memory of 1524	760	cmd.exe	28
PID 760 wrote to memory of 1524	760	cmd.exe	28
PID 760 wrote to memory of 1524	760	cmd.exe	28
PID 760 wrote to memory of 1524	760	cmd.exe	28
PID 1116 wrote to memory of 1696	1116	cmd.exe	29
PID 1116 wrote to memory of 1696	1116	cmd.exe	29
PID 1116 wrote to memory of 1696	1116	cmd.exe	29
PID 1116 wrote to memory of 1696	1116	cmd.exe	29
PID 1164 wrote to memory of 1384	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	30
PID 1164 wrote to memory of 1384	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	30
PID 1164 wrote to memory of 1384	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	30
PID 1164 wrote to memory of 1384	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	30
PID 1164 wrote to memory of 1852	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	31
PID 1164 wrote to memory of 1852	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	31
PID 1164 wrote to memory of 1852	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	31
PID 1164 wrote to memory of 1852	1164	2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe	31
PID 1852 wrote to memory of 1892	1852	msdcsc.exe	32
PID 1852 wrote to memory of 1892	1852	msdcsc.exe	32
PID 1852 wrote to memory of 1892	1852	msdcsc.exe	32
PID 1852 wrote to memory of 1892	1852	msdcsc.exe	32
PID 1852 wrote to memory of 1932	1852	msdcsc.exe	33
PID 1852 wrote to memory of 1932	1852	msdcsc.exe	33
PID 1852 wrote to memory of 1932	1852	msdcsc.exe	33
PID 1852 wrote to memory of 1932	1852	msdcsc.exe	33
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34
PID 1852 wrote to memory of 1924	1852	msdcsc.exe	34

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1524	attrib.exe
1696	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
"C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe" +s +h
    3⤵
    - Views/modifies file attributes
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Views/modifies file attributes
    PID:1696
- C:\Users\Admin\AppData\Local\Temp\MAIN.EXE
  "C:\Users\Admin\AppData\Local\Temp\MAIN.EXE"
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:1892
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1924