darkcomet | 491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

General

Target

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Size

821KB
MD5

d9b36a4b92a93b667270722827c7d303
SHA1

cfaec9d1e7557c483a3415fb4496735c6da181dc
SHA256

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099
SHA512

11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Drops file in Drivers directory 1 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

3116 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
3116	msdcsc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

msdcsc.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

3116 msdcsc.exe

pid	process
3116	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSecurityPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeTakeOwnershipPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeLoadDriverPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSystemProfilePrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSystemtimePrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeProfSingleProcessPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeIncBasePriorityPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeCreatePagefilePrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeBackupPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeRestorePrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeShutdownPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeDebugPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeSystemEnvironmentPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeChangeNotifyPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeRemoteShutdownPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeUndockPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeManageVolumePrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeImpersonatePrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeCreateGlobalPrivilege	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: 33	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: 34	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: 35	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: 36	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
Token: SeIncreaseQuotaPrivilege	3116	msdcsc.exe
Token: SeSecurityPrivilege	3116	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3116	msdcsc.exe
Token: SeLoadDriverPrivilege	3116	msdcsc.exe
Token: SeSystemProfilePrivilege	3116	msdcsc.exe
Token: SeSystemtimePrivilege	3116	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3116	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3116	msdcsc.exe
Token: SeCreatePagefilePrivilege	3116	msdcsc.exe
Token: SeBackupPrivilege	3116	msdcsc.exe
Token: SeRestorePrivilege	3116	msdcsc.exe
Token: SeShutdownPrivilege	3116	msdcsc.exe
Token: SeDebugPrivilege	3116	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3116	msdcsc.exe
Token: SeChangeNotifyPrivilege	3116	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3116	msdcsc.exe
Token: SeUndockPrivilege	3116	msdcsc.exe
Token: SeManageVolumePrivilege	3116	msdcsc.exe
Token: SeImpersonatePrivilege	3116	msdcsc.exe
Token: SeCreateGlobalPrivilege	3116	msdcsc.exe
Token: 33	3116	msdcsc.exe
Token: 34	3116	msdcsc.exe
Token: 35	3116	msdcsc.exe
Token: 36	3116	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

3116 msdcsc.exe

pid	process
3116	msdcsc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 672 wrote to memory of 3036	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 672 wrote to memory of 3036	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 672 wrote to memory of 3036	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 672 wrote to memory of 3584	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 672 wrote to memory of 3584	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 672 wrote to memory of 3584	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	cmd.exe
PID 3584 wrote to memory of 196	3584	cmd.exe	attrib.exe
PID 3584 wrote to memory of 196	3584	cmd.exe	attrib.exe
PID 3584 wrote to memory of 196	3584	cmd.exe	attrib.exe
PID 3036 wrote to memory of 1128	3036	cmd.exe	attrib.exe
PID 3036 wrote to memory of 1128	3036	cmd.exe	attrib.exe
PID 3036 wrote to memory of 1128	3036	cmd.exe	attrib.exe
PID 672 wrote to memory of 3116	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	msdcsc.exe
PID 672 wrote to memory of 3116	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	msdcsc.exe
PID 672 wrote to memory of 3116	672	491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe	msdcsc.exe
PID 3116 wrote to memory of 2068	3116	msdcsc.exe	iexplore.exe
PID 3116 wrote to memory of 2068	3116	msdcsc.exe	iexplore.exe
PID 3116 wrote to memory of 2068	3116	msdcsc.exe	iexplore.exe
PID 3116 wrote to memory of 1420	3116	msdcsc.exe	explorer.exe
PID 3116 wrote to memory of 1420	3116	msdcsc.exe	explorer.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

196 attrib.exe
1128 attrib.exe

pid	process
196	attrib.exe
1128	attrib.exe

C:\Users\Admin\AppData\Local\Temp\491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe
"C:\Users\Admin\AppData\Local\Temp\491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:1128

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:196

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:2068

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
PID:1420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

2

T1031

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

T1112

Disabling Security Tools

2

T1089

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
d9b36a4b92a93b667270722827c7d303

SHA1
cfaec9d1e7557c483a3415fb4496735c6da181dc

SHA256
491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

SHA512
11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
d9b36a4b92a93b667270722827c7d303

SHA1
cfaec9d1e7557c483a3415fb4496735c6da181dc

SHA256
491544e52e7cc8c4260647abcb38138c21e34406d4e553936c5e1be8931c0099

SHA512
11299d1e2388e7132e47dfb2b72cc1a98a92ecb29500082c763f237f2f4f023fb650af7901e6402889fd9a014e55cd4d30464740839f53cdd05f85a65a1ff665

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
MD5
b774ae3fb1da087e1f83b4f7b2060e5a

SHA1
97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

SHA256
adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

SHA512
f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

Download Submit
memory/196-118-0x0000000000000000-mapping.dmp

Download
memory/672-114-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1128-119-0x0000000000000000-mapping.dmp

Download
memory/3036-115-0x0000000000000000-mapping.dmp

Download
memory/3116-120-0x0000000000000000-mapping.dmp

Download
memory/3116-123-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3584-116-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads