darkcomet | 273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd

Analysis

max time kernel
150s
max time network
140s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
Size

1.8MB
MD5

9dac373d8e40e65460db0238cb110473
SHA1

240d9a67dbb28122beb4569a3fe04788459d5628
SHA256

273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd
SHA512

47f593b674ef732eabe676f569c51764ea73f60778cb033bd0cf92830e44d51bb6e08f319c9de04ad65abb39d807bc3fda5d93313db6424c9393ce64dd9f4a96

Score

10^/10

darkcomet vbsted evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

vbsted

forshared.ddns.net:6722

Mutex

DC_MUTEX-6UPV0L8

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
kWdnrSvNCdV5
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	RegSvcs.exe

Executes dropped EXE 5 IoCs

Processes:

kngmpwequb.pifRegSvcs.exemsdcsc.exekngmpwequb.pifRegSvcs.exe

pid process

636 kngmpwequb.pif
3460 RegSvcs.exe
1172 msdcsc.exe
3180 kngmpwequb.pif
804 RegSvcs.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kngmpwequb.pifkngmpwequb.pifRegSvcs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	kngmpwequb.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN"	kngmpwequb.pif
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	kngmpwequb.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN"	kngmpwequb.pif
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

kngmpwequb.pifkngmpwequb.pif

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kngmpwequb.pif
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kngmpwequb.pif

Suspicious use of SetThreadContext 2 IoCs

Processes:

kngmpwequb.pifkngmpwequb.pif

description	pid	process	target process
PID 636 set thread context of 3460	636	kngmpwequb.pif	RegSvcs.exe
PID 3180 set thread context of 804	3180	kngmpwequb.pif	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

kngmpwequb.pif

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings kngmpwequb.pif

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	kngmpwequb.pif

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

kngmpwequb.pifkngmpwequb.pif

pid	process
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
636	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif
3180	kngmpwequb.pif

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

RegSvcs.exeRegSvcs.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3460	RegSvcs.exe
Token: SeSecurityPrivilege	3460	RegSvcs.exe
Token: SeTakeOwnershipPrivilege	3460	RegSvcs.exe
Token: SeLoadDriverPrivilege	3460	RegSvcs.exe
Token: SeSystemProfilePrivilege	3460	RegSvcs.exe
Token: SeSystemtimePrivilege	3460	RegSvcs.exe
Token: SeProfSingleProcessPrivilege	3460	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3460	RegSvcs.exe
Token: SeCreatePagefilePrivilege	3460	RegSvcs.exe
Token: SeBackupPrivilege	3460	RegSvcs.exe
Token: SeRestorePrivilege	3460	RegSvcs.exe
Token: SeShutdownPrivilege	3460	RegSvcs.exe
Token: SeDebugPrivilege	3460	RegSvcs.exe
Token: SeSystemEnvironmentPrivilege	3460	RegSvcs.exe
Token: SeChangeNotifyPrivilege	3460	RegSvcs.exe
Token: SeRemoteShutdownPrivilege	3460	RegSvcs.exe
Token: SeUndockPrivilege	3460	RegSvcs.exe
Token: SeManageVolumePrivilege	3460	RegSvcs.exe
Token: SeImpersonatePrivilege	3460	RegSvcs.exe
Token: SeCreateGlobalPrivilege	3460	RegSvcs.exe
Token: 33	3460	RegSvcs.exe
Token: 34	3460	RegSvcs.exe
Token: 35	3460	RegSvcs.exe
Token: 36	3460	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	804	RegSvcs.exe
Token: SeSecurityPrivilege	804	RegSvcs.exe
Token: SeTakeOwnershipPrivilege	804	RegSvcs.exe
Token: SeLoadDriverPrivilege	804	RegSvcs.exe
Token: SeSystemProfilePrivilege	804	RegSvcs.exe
Token: SeSystemtimePrivilege	804	RegSvcs.exe
Token: SeProfSingleProcessPrivilege	804	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	804	RegSvcs.exe
Token: SeCreatePagefilePrivilege	804	RegSvcs.exe
Token: SeBackupPrivilege	804	RegSvcs.exe
Token: SeRestorePrivilege	804	RegSvcs.exe
Token: SeShutdownPrivilege	804	RegSvcs.exe
Token: SeDebugPrivilege	804	RegSvcs.exe
Token: SeSystemEnvironmentPrivilege	804	RegSvcs.exe
Token: SeChangeNotifyPrivilege	804	RegSvcs.exe
Token: SeRemoteShutdownPrivilege	804	RegSvcs.exe
Token: SeUndockPrivilege	804	RegSvcs.exe
Token: SeManageVolumePrivilege	804	RegSvcs.exe
Token: SeImpersonatePrivilege	804	RegSvcs.exe
Token: SeCreateGlobalPrivilege	804	RegSvcs.exe
Token: 33	804	RegSvcs.exe
Token: 34	804	RegSvcs.exe
Token: 35	804	RegSvcs.exe
Token: 36	804	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

804 RegSvcs.exe

pid	process
804	RegSvcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exekngmpwequb.pifRegSvcs.exeWScript.exekngmpwequb.pif

description	pid	process	target process
PID 1080 wrote to memory of 636	1080	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe	kngmpwequb.pif
PID 1080 wrote to memory of 636	1080	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe	kngmpwequb.pif
PID 1080 wrote to memory of 636	1080	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe	kngmpwequb.pif
PID 636 wrote to memory of 3460	636	kngmpwequb.pif	RegSvcs.exe
PID 636 wrote to memory of 3460	636	kngmpwequb.pif	RegSvcs.exe
PID 636 wrote to memory of 3460	636	kngmpwequb.pif	RegSvcs.exe
PID 636 wrote to memory of 3460	636	kngmpwequb.pif	RegSvcs.exe
PID 636 wrote to memory of 3460	636	kngmpwequb.pif	RegSvcs.exe
PID 3460 wrote to memory of 1172	3460	RegSvcs.exe	msdcsc.exe
PID 3460 wrote to memory of 1172	3460	RegSvcs.exe	msdcsc.exe
PID 3460 wrote to memory of 1172	3460	RegSvcs.exe	msdcsc.exe
PID 636 wrote to memory of 3884	636	kngmpwequb.pif	WScript.exe
PID 636 wrote to memory of 3884	636	kngmpwequb.pif	WScript.exe
PID 636 wrote to memory of 3884	636	kngmpwequb.pif	WScript.exe
PID 3884 wrote to memory of 3180	3884	WScript.exe	kngmpwequb.pif
PID 3884 wrote to memory of 3180	3884	WScript.exe	kngmpwequb.pif
PID 3884 wrote to memory of 3180	3884	WScript.exe	kngmpwequb.pif
PID 3180 wrote to memory of 804	3180	kngmpwequb.pif	RegSvcs.exe
PID 3180 wrote to memory of 804	3180	kngmpwequb.pif	RegSvcs.exe
PID 3180 wrote to memory of 804	3180	kngmpwequb.pif	RegSvcs.exe
PID 3180 wrote to memory of 804	3180	kngmpwequb.pif	RegSvcs.exe
PID 3180 wrote to memory of 804	3180	kngmpwequb.pif	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
"C:\Users\Admin\AppData\Local\Temp\273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\33725277\kngmpwequb.pif
"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
PID:1172

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\33725277\run.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:3884

C:\33725277\kngmpwequb.pif
"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3180

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\33725277\arggi.xls
MD5
823007f5c65d9fe990fc54bf62115e57

SHA1
4f82f8ecbd22962e5cc3fc0db945f624152395e7

SHA256
3c7a08daedb21220704ed349c7653a3e49b832b1f5680511e34c13842ded7674

SHA512
1fbe5f6b3d7cc883b1a32d9ddabe30971b3c5e3da246fbef9f34c08da3121cb60a8298be22e60c083c1afc392f259f34d0c5718b22b5ccc168af5473344a53d7

Download Submit
C:\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
C:\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
C:\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
C:\33725277\run.vbs
MD5
bd16d4520614b3c9d71e2e0c83ca5d13

SHA1
6e402d7033b0a07c4bcbd1f5a99603b2e9a6e5a9

SHA256
a9cf9d1cb3b01df857a63916ca3f930c496be6508f8f5fc1f831c98e65c181f5

SHA512
431a0c9f162f4527ffefe3bc41eb872710229b03abf0f3e17840dc6c3e5e4336872af4aec23105b7b3686e5c451b022eb4144998a4f16f7be90409f4b1606b4e

Download Submit
C:\33725277\xpomrfvel.rqn
MD5
39b173c9805bd7eafa796540be0bc0c3

SHA1
c78582ee6526e8c962322a4d66b0f816ed2bdc36

SHA256
4b8662365d2085b4aa04273e740ffa1357e3cbac5590cc4b846a174b0e2d6e71

SHA512
5eae3743a7b80868d0f64abe51ad4c56ce39a2e10fb0333f23ff4248328270eda9d74463dec3c07cad9cb5a1ebff97090f355663966b1ac9217b6407c97415f7

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
memory/636-5-0x0000000072300000-0x0000000072393000-memory.dmp

Filesize
588KB

Download
memory/636-2-0x0000000000000000-mapping.dmp

Download
memory/804-39-0x00000000007DF888-mapping.dmp

Download
memory/804-38-0x0000000000750000-0x0000000000D33000-memory.dmp

Filesize
5.9MB

Download
memory/804-41-0x0000000000750000-0x0000000000D33000-memory.dmp

Filesize
5.9MB

Download
memory/1172-35-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/1172-33-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1172-34-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/1172-18-0x0000000072D70000-0x000000007345E000-memory.dmp

Filesize
6.9MB

Download
memory/1172-17-0x0000000072300000-0x0000000072393000-memory.dmp

Filesize
588KB

Download
memory/1172-14-0x0000000000000000-mapping.dmp

Download
memory/3180-36-0x0000000000000000-mapping.dmp

Download
memory/3460-13-0x0000000000830000-0x0000000000E26000-memory.dmp

Filesize
6.0MB

Download
memory/3460-12-0x0000000072300000-0x0000000072393000-memory.dmp

Filesize
588KB

Download
memory/3460-9-0x00000000008BF888-mapping.dmp

Download
memory/3460-8-0x0000000000830000-0x0000000000E26000-memory.dmp

Filesize
6.0MB

Download
memory/3884-19-0x0000000000000000-mapping.dmp

Download