darkcomet | aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2

General

Target

aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Size

349KB
MD5

3bc048af20476d5a8c440a33bd2eb9a0
SHA1

bcd51807e3ac07837ecdc024d0b13e828249c424
SHA256

aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2
SHA512

e7d2a491626ea66066c475d25196ac2ca99a28d036e1e8be71780b6b40b31a67985fd3d723950c4cf94a880f6cc2639a0ac727bc92717701df0b82da874b2cd1

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\msdcsc.exe"	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

1480 msdcsc.exe

pid	process
1480	msdcsc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe	upx
\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe	upx
C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe	upx
C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe	upx

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

2012 notepad.exe

pid	process
2012	notepad.exe

Loads dropped DLL 2 IoCs

Processes:

aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe

pid	process
684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\msdcsc.exe"	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeSecurityPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeTakeOwnershipPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeLoadDriverPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeSystemProfilePrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeSystemtimePrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeProfSingleProcessPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeIncBasePriorityPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeCreatePagefilePrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeBackupPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeRestorePrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeShutdownPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeDebugPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeSystemEnvironmentPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeChangeNotifyPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeRemoteShutdownPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeUndockPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeManageVolumePrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeImpersonatePrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeCreateGlobalPrivilege	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: 33	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: 34	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: 35	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
Token: SeIncreaseQuotaPrivilege	1480	msdcsc.exe
Token: SeSecurityPrivilege	1480	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1480	msdcsc.exe
Token: SeLoadDriverPrivilege	1480	msdcsc.exe
Token: SeSystemProfilePrivilege	1480	msdcsc.exe
Token: SeSystemtimePrivilege	1480	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1480	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1480	msdcsc.exe
Token: SeCreatePagefilePrivilege	1480	msdcsc.exe
Token: SeBackupPrivilege	1480	msdcsc.exe
Token: SeRestorePrivilege	1480	msdcsc.exe
Token: SeShutdownPrivilege	1480	msdcsc.exe
Token: SeDebugPrivilege	1480	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1480	msdcsc.exe
Token: SeChangeNotifyPrivilege	1480	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1480	msdcsc.exe
Token: SeUndockPrivilege	1480	msdcsc.exe
Token: SeManageVolumePrivilege	1480	msdcsc.exe
Token: SeImpersonatePrivilege	1480	msdcsc.exe
Token: SeCreateGlobalPrivilege	1480	msdcsc.exe
Token: 33	1480	msdcsc.exe
Token: 34	1480	msdcsc.exe
Token: 35	1480	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

1480 msdcsc.exe

pid	process
1480	msdcsc.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe

description	pid	process	target process
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 2012	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	notepad.exe
PID 684 wrote to memory of 1480	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	msdcsc.exe
PID 684 wrote to memory of 1480	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	msdcsc.exe
PID 684 wrote to memory of 1480	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	msdcsc.exe
PID 684 wrote to memory of 1480	684	aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe
"C:\Users\Admin\AppData\Local\Temp\aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Deletes itself
PID:2012

C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe
MD5
3bc048af20476d5a8c440a33bd2eb9a0

SHA1
bcd51807e3ac07837ecdc024d0b13e828249c424

SHA256
aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2

SHA512
e7d2a491626ea66066c475d25196ac2ca99a28d036e1e8be71780b6b40b31a67985fd3d723950c4cf94a880f6cc2639a0ac727bc92717701df0b82da874b2cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe
MD5
3bc048af20476d5a8c440a33bd2eb9a0

SHA1
bcd51807e3ac07837ecdc024d0b13e828249c424

SHA256
aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2

SHA512
e7d2a491626ea66066c475d25196ac2ca99a28d036e1e8be71780b6b40b31a67985fd3d723950c4cf94a880f6cc2639a0ac727bc92717701df0b82da874b2cd1

Download Submit
\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe
MD5
3bc048af20476d5a8c440a33bd2eb9a0

SHA1
bcd51807e3ac07837ecdc024d0b13e828249c424

SHA256
aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2

SHA512
e7d2a491626ea66066c475d25196ac2ca99a28d036e1e8be71780b6b40b31a67985fd3d723950c4cf94a880f6cc2639a0ac727bc92717701df0b82da874b2cd1

Download Submit
\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe
MD5
3bc048af20476d5a8c440a33bd2eb9a0

SHA1
bcd51807e3ac07837ecdc024d0b13e828249c424

SHA256
aad35a5504c45513c4dd2488a13848d3ddbad34e0ebca7dbce4949d4b17651a2

SHA512
e7d2a491626ea66066c475d25196ac2ca99a28d036e1e8be71780b6b40b31a67985fd3d723950c4cf94a880f6cc2639a0ac727bc92717701df0b82da874b2cd1

Download Submit
memory/1480-5-0x0000000000000000-mapping.dmp

Download
memory/2012-0-0x0000000000000000-mapping.dmp

Download
memory/2012-2-0x0000000000000000-mapping.dmp

Download
memory/2012-1-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads