darkcomet | 9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415

General

Target

9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Size

252KB
MD5

fef2b1e52220b33ec700d73f59405632
SHA1

56bde46cd9d9998fdbf5a1c95036d3a84cf46d17
SHA256

9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415
SHA512

32f1f8e64d64ea931d06d91c426bc79bc503a5811e6786c923f7e9c290e94203b4924ec09fa7b4ad074936afafcc25394042b258bd4ee9eb5ec13aaa172f6d04

Score

10^/10

darkcomet evasion persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe

Disables RegEdit via registry modification
evasion
Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

1976 msdcsc.exe

pid	process
1976	msdcsc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe	upx
\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe	upx
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe	upx
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe	upx

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

1456 notepad.exe

pid	process
1456	notepad.exe

Loads dropped DLL 2 IoCs

Processes:

9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe

pid	process
1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeSecurityPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeTakeOwnershipPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeLoadDriverPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeSystemProfilePrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeSystemtimePrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeProfSingleProcessPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeIncBasePriorityPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeCreatePagefilePrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeBackupPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeRestorePrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeShutdownPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeDebugPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeSystemEnvironmentPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeChangeNotifyPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeRemoteShutdownPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeUndockPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeManageVolumePrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeImpersonatePrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeCreateGlobalPrivilege	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: 33	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: 34	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: 35	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
Token: SeIncreaseQuotaPrivilege	1976	msdcsc.exe
Token: SeSecurityPrivilege	1976	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1976	msdcsc.exe
Token: SeLoadDriverPrivilege	1976	msdcsc.exe
Token: SeSystemProfilePrivilege	1976	msdcsc.exe
Token: SeSystemtimePrivilege	1976	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1976	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1976	msdcsc.exe
Token: SeCreatePagefilePrivilege	1976	msdcsc.exe
Token: SeBackupPrivilege	1976	msdcsc.exe
Token: SeRestorePrivilege	1976	msdcsc.exe
Token: SeShutdownPrivilege	1976	msdcsc.exe
Token: SeDebugPrivilege	1976	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1976	msdcsc.exe
Token: SeChangeNotifyPrivilege	1976	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1976	msdcsc.exe
Token: SeUndockPrivilege	1976	msdcsc.exe
Token: SeManageVolumePrivilege	1976	msdcsc.exe
Token: SeImpersonatePrivilege	1976	msdcsc.exe
Token: SeCreateGlobalPrivilege	1976	msdcsc.exe
Token: 33	1976	msdcsc.exe
Token: 34	1976	msdcsc.exe
Token: 35	1976	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

1976 msdcsc.exe

pid	process
1976	msdcsc.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe

description	pid	process	target process
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1456	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	notepad.exe
PID 1360 wrote to memory of 1976	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	msdcsc.exe
PID 1360 wrote to memory of 1976	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	msdcsc.exe
PID 1360 wrote to memory of 1976	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	msdcsc.exe
PID 1360 wrote to memory of 1976	1360	9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe
"C:\Users\Admin\AppData\Local\Temp\9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Deletes itself
PID:1456

C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
MD5
fef2b1e52220b33ec700d73f59405632

SHA1
56bde46cd9d9998fdbf5a1c95036d3a84cf46d17

SHA256
9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415

SHA512
32f1f8e64d64ea931d06d91c426bc79bc503a5811e6786c923f7e9c290e94203b4924ec09fa7b4ad074936afafcc25394042b258bd4ee9eb5ec13aaa172f6d04

Download Submit
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
MD5
fef2b1e52220b33ec700d73f59405632

SHA1
56bde46cd9d9998fdbf5a1c95036d3a84cf46d17

SHA256
9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415

SHA512
32f1f8e64d64ea931d06d91c426bc79bc503a5811e6786c923f7e9c290e94203b4924ec09fa7b4ad074936afafcc25394042b258bd4ee9eb5ec13aaa172f6d04

Download Submit
\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
MD5
fef2b1e52220b33ec700d73f59405632

SHA1
56bde46cd9d9998fdbf5a1c95036d3a84cf46d17

SHA256
9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415

SHA512
32f1f8e64d64ea931d06d91c426bc79bc503a5811e6786c923f7e9c290e94203b4924ec09fa7b4ad074936afafcc25394042b258bd4ee9eb5ec13aaa172f6d04

Download Submit
\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
MD5
fef2b1e52220b33ec700d73f59405632

SHA1
56bde46cd9d9998fdbf5a1c95036d3a84cf46d17

SHA256
9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415

SHA512
32f1f8e64d64ea931d06d91c426bc79bc503a5811e6786c923f7e9c290e94203b4924ec09fa7b4ad074936afafcc25394042b258bd4ee9eb5ec13aaa172f6d04

Download Submit
memory/1456-0-0x0000000000000000-mapping.dmp

Download
memory/1456-2-0x0000000000000000-mapping.dmp

Download
memory/1456-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1976-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads