darkcomet | 491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

General

Target

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Size

821KB
MD5

d9b36a4b92a93b667270722827c7d303
SHA1

cfaec9d1e7557c483a3415fb4496735c6da181dc
SHA256

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099
SHA512

11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

iexplore.exemsdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	iexplore.exe

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Drops file in Drivers directory 1 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

548 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
548	msdcsc.exe

Loads dropped DLL 2 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

pid	process
1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

msdcsc.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

msdcsc.exe

description pid process target process

PID 548 set thread context of 1248 548 msdcsc.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1248 iexplore.exe

description	pid	process	target process
PID 548 set thread context of 1248	548	msdcsc.exe	iexplore.exe

pid	process
1248	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exemsdcsc.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSecurityPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeTakeOwnershipPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeLoadDriverPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSystemProfilePrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSystemtimePrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeProfSingleProcessPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeIncBasePriorityPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeCreatePagefilePrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeBackupPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeRestorePrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeShutdownPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeDebugPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSystemEnvironmentPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeChangeNotifyPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeRemoteShutdownPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeUndockPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeManageVolumePrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeImpersonatePrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeCreateGlobalPrivilege	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: 33	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: 34	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: 35	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeIncreaseQuotaPrivilege	548	msdcsc.exe
Token: SeSecurityPrivilege	548	msdcsc.exe
Token: SeTakeOwnershipPrivilege	548	msdcsc.exe
Token: SeLoadDriverPrivilege	548	msdcsc.exe
Token: SeSystemProfilePrivilege	548	msdcsc.exe
Token: SeSystemtimePrivilege	548	msdcsc.exe
Token: SeProfSingleProcessPrivilege	548	msdcsc.exe
Token: SeIncBasePriorityPrivilege	548	msdcsc.exe
Token: SeCreatePagefilePrivilege	548	msdcsc.exe
Token: SeBackupPrivilege	548	msdcsc.exe
Token: SeRestorePrivilege	548	msdcsc.exe
Token: SeShutdownPrivilege	548	msdcsc.exe
Token: SeDebugPrivilege	548	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	548	msdcsc.exe
Token: SeChangeNotifyPrivilege	548	msdcsc.exe
Token: SeRemoteShutdownPrivilege	548	msdcsc.exe
Token: SeUndockPrivilege	548	msdcsc.exe
Token: SeManageVolumePrivilege	548	msdcsc.exe
Token: SeImpersonatePrivilege	548	msdcsc.exe
Token: SeCreateGlobalPrivilege	548	msdcsc.exe
Token: 33	548	msdcsc.exe
Token: 34	548	msdcsc.exe
Token: 35	548	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	1248	iexplore.exe
Token: SeSecurityPrivilege	1248	iexplore.exe
Token: SeTakeOwnershipPrivilege	1248	iexplore.exe
Token: SeLoadDriverPrivilege	1248	iexplore.exe
Token: SeSystemProfilePrivilege	1248	iexplore.exe
Token: SeSystemtimePrivilege	1248	iexplore.exe
Token: SeProfSingleProcessPrivilege	1248	iexplore.exe
Token: SeIncBasePriorityPrivilege	1248	iexplore.exe
Token: SeCreatePagefilePrivilege	1248	iexplore.exe
Token: SeBackupPrivilege	1248	iexplore.exe
Token: SeRestorePrivilege	1248	iexplore.exe
Token: SeShutdownPrivilege	1248	iexplore.exe
Token: SeDebugPrivilege	1248	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1248	iexplore.exe
Token: SeChangeNotifyPrivilege	1248	iexplore.exe
Token: SeRemoteShutdownPrivilege	1248	iexplore.exe
Token: SeUndockPrivilege	1248	iexplore.exe
Token: SeManageVolumePrivilege	1248	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

1248 iexplore.exe

pid	process
1248	iexplore.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 1100 wrote to memory of 1584	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1100 wrote to memory of 1584	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1100 wrote to memory of 1584	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1100 wrote to memory of 1584	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1100 wrote to memory of 1636	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1100 wrote to memory of 1636	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1100 wrote to memory of 1636	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1100 wrote to memory of 1636	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 1584 wrote to memory of 644	1584	cmd.exe	attrib.exe
PID 1584 wrote to memory of 644	1584	cmd.exe	attrib.exe
PID 1584 wrote to memory of 644	1584	cmd.exe	attrib.exe
PID 1584 wrote to memory of 644	1584	cmd.exe	attrib.exe
PID 1636 wrote to memory of 284	1636	cmd.exe	attrib.exe
PID 1636 wrote to memory of 284	1636	cmd.exe	attrib.exe
PID 1636 wrote to memory of 284	1636	cmd.exe	attrib.exe
PID 1636 wrote to memory of 284	1636	cmd.exe	attrib.exe
PID 1100 wrote to memory of 548	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	msdcsc.exe
PID 1100 wrote to memory of 548	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	msdcsc.exe
PID 1100 wrote to memory of 548	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	msdcsc.exe
PID 1100 wrote to memory of 548	1100	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	msdcsc.exe
PID 548 wrote to memory of 1248	548	msdcsc.exe	iexplore.exe
PID 548 wrote to memory of 1248	548	msdcsc.exe	iexplore.exe
PID 548 wrote to memory of 1248	548	msdcsc.exe	iexplore.exe
PID 548 wrote to memory of 1248	548	msdcsc.exe	iexplore.exe
PID 548 wrote to memory of 1248	548	msdcsc.exe	iexplore.exe
PID 548 wrote to memory of 1248	548	msdcsc.exe	iexplore.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

284 attrib.exe
644 attrib.exe

pid	process
284	attrib.exe
644	attrib.exe

C:\Users\Admin\AppData\Local\Temp\491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
"C:\Users\Admin\AppData\Local\Temp\491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:644

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:284

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Modifies firewall policy service
- Modifies security service
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

2

T1031

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

T1112

Disabling Security Tools

2

T1089

Hidden Files and Directories

2

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
d9b36a4b92a93b667270722827c7d303

SHA1
cfaec9d1e7557c483a3415fb4496735c6da181dc

SHA256
491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

SHA512
11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
d9b36a4b92a93b667270722827c7d303

SHA1
cfaec9d1e7557c483a3415fb4496735c6da181dc

SHA256
491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

SHA512
11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
MD5
b774ae3fb1da087e1f83b4f7b2060e5a

SHA1
97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

SHA256
adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

SHA512
f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
d9b36a4b92a93b667270722827c7d303

SHA1
cfaec9d1e7557c483a3415fb4496735c6da181dc

SHA256
491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

SHA512
11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
d9b36a4b92a93b667270722827c7d303

SHA1
cfaec9d1e7557c483a3415fb4496735c6da181dc

SHA256
491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

SHA512
11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Download Submit
memory/284-66-0x0000000000000000-mapping.dmp

Download
memory/548-75-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/548-69-0x0000000000000000-mapping.dmp

Download
memory/644-65-0x0000000000000000-mapping.dmp

Download
memory/1100-60-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download
memory/1100-61-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1248-73-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/1248-74-0x000000000049F92C-mapping.dmp

Download
memory/1584-62-0x0000000000000000-mapping.dmp

Download
memory/1636-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads