darkcomet | de19d8ea2911ff7e337823576e214151ad4426206db8e9ea9880778f2592f935

General

Target

FOTOVERANO15.scr
Size

874KB
MD5

ec692bde91ad1c6e182843bc0a5c7e81
SHA1

54996c1d4aeaf76855b7b73a323b74c191573863
SHA256

de19d8ea2911ff7e337823576e214151ad4426206db8e9ea9880778f2592f935
SHA512

4b4d5b7707071b86cb2d55411766bb3ebde9a8765becdaf5840d78be6e278f5b3d2bbe2888350a4d113c49a65c9b8e2ec818429db91c72529b0fbfd12f9c7dbe

Score

10^/10

darkcomet fotoverano15 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

FOTOVERANO15

C2

seguridadsocial.ddns.net:1604

Mutex

DC_MUTEX-MKHPJPY

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
lsBsa7lPZ9Fu
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

FOTOVERANO15.scr

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FOTOVERANO15.scr

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

1432 msdcsc.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

1516 notepad.exe
Loads dropped DLL 2 IoCs

Processes:

FOTOVERANO15.scr

pid process

1072 FOTOVERANO15.scr
1072 FOTOVERANO15.scr

pid	process
1432	msdcsc.exe

pid	process
1516	notepad.exe

pid	process
1072	FOTOVERANO15.scr
1072	FOTOVERANO15.scr

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

FOTOVERANO15.scrmsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FOTOVERANO15.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

FOTOVERANO15.scrmsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1072	FOTOVERANO15.scr
Token: SeSecurityPrivilege	1072	FOTOVERANO15.scr
Token: SeTakeOwnershipPrivilege	1072	FOTOVERANO15.scr
Token: SeLoadDriverPrivilege	1072	FOTOVERANO15.scr
Token: SeSystemProfilePrivilege	1072	FOTOVERANO15.scr
Token: SeSystemtimePrivilege	1072	FOTOVERANO15.scr
Token: SeProfSingleProcessPrivilege	1072	FOTOVERANO15.scr
Token: SeIncBasePriorityPrivilege	1072	FOTOVERANO15.scr
Token: SeCreatePagefilePrivilege	1072	FOTOVERANO15.scr
Token: SeBackupPrivilege	1072	FOTOVERANO15.scr
Token: SeRestorePrivilege	1072	FOTOVERANO15.scr
Token: SeShutdownPrivilege	1072	FOTOVERANO15.scr
Token: SeDebugPrivilege	1072	FOTOVERANO15.scr
Token: SeSystemEnvironmentPrivilege	1072	FOTOVERANO15.scr
Token: SeChangeNotifyPrivilege	1072	FOTOVERANO15.scr
Token: SeRemoteShutdownPrivilege	1072	FOTOVERANO15.scr
Token: SeUndockPrivilege	1072	FOTOVERANO15.scr
Token: SeManageVolumePrivilege	1072	FOTOVERANO15.scr
Token: SeImpersonatePrivilege	1072	FOTOVERANO15.scr
Token: SeCreateGlobalPrivilege	1072	FOTOVERANO15.scr
Token: 33	1072	FOTOVERANO15.scr
Token: 34	1072	FOTOVERANO15.scr
Token: 35	1072	FOTOVERANO15.scr
Token: SeIncreaseQuotaPrivilege	1432	msdcsc.exe
Token: SeSecurityPrivilege	1432	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1432	msdcsc.exe
Token: SeLoadDriverPrivilege	1432	msdcsc.exe
Token: SeSystemProfilePrivilege	1432	msdcsc.exe
Token: SeSystemtimePrivilege	1432	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1432	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1432	msdcsc.exe
Token: SeCreatePagefilePrivilege	1432	msdcsc.exe
Token: SeBackupPrivilege	1432	msdcsc.exe
Token: SeRestorePrivilege	1432	msdcsc.exe
Token: SeShutdownPrivilege	1432	msdcsc.exe
Token: SeDebugPrivilege	1432	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1432	msdcsc.exe
Token: SeChangeNotifyPrivilege	1432	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1432	msdcsc.exe
Token: SeUndockPrivilege	1432	msdcsc.exe
Token: SeManageVolumePrivilege	1432	msdcsc.exe
Token: SeImpersonatePrivilege	1432	msdcsc.exe
Token: SeCreateGlobalPrivilege	1432	msdcsc.exe
Token: 33	1432	msdcsc.exe
Token: 34	1432	msdcsc.exe
Token: 35	1432	msdcsc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1924 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

1432 msdcsc.exe

pid	process
1924	DllHost.exe

pid	process
1432	msdcsc.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

FOTOVERANO15.scrmsdcsc.exe

description	pid	process	target process
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1516	1072	FOTOVERANO15.scr	notepad.exe
PID 1072 wrote to memory of 1432	1072	FOTOVERANO15.scr	msdcsc.exe
PID 1072 wrote to memory of 1432	1072	FOTOVERANO15.scr	msdcsc.exe
PID 1072 wrote to memory of 1432	1072	FOTOVERANO15.scr	msdcsc.exe
PID 1072 wrote to memory of 1432	1072	FOTOVERANO15.scr	msdcsc.exe
PID 1432 wrote to memory of 1540	1432	msdcsc.exe	iexplore.exe
PID 1432 wrote to memory of 1540	1432	msdcsc.exe	iexplore.exe
PID 1432 wrote to memory of 1540	1432	msdcsc.exe	iexplore.exe
PID 1432 wrote to memory of 1540	1432	msdcsc.exe	iexplore.exe
PID 1432 wrote to memory of 1620	1432	msdcsc.exe	explorer.exe
PID 1432 wrote to memory of 1620	1432	msdcsc.exe	explorer.exe
PID 1432 wrote to memory of 1620	1432	msdcsc.exe	explorer.exe
PID 1432 wrote to memory of 1620	1432	msdcsc.exe	explorer.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe
PID 1432 wrote to memory of 1564	1432	msdcsc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\FOTOVERANO15.scr
"C:\Users\Admin\AppData\Local\Temp\FOTOVERANO15.scr" /S
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Deletes itself
PID:1516

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1540

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
PID:1620

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1564

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FOTOVERANO15.JPG

MD5
aeffb88a40a4be078244229bcfee3d2f

SHA1
d7289fe88f0929c36dd642f2b16bdb649bbc88eb

SHA256
71204f05c21a26aba9343ec13042d96ae3b3bf6702a38dd3a6a42a09ee96042b

SHA512
af0c7e413680b62d12445bee0577bf288195395b4935cf9a5fbe372d4ea490d6ab07082d24d7f72ca020a8e0ccca713a800a3eb0aebb38b3ddb629d083538d80

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5
ec692bde91ad1c6e182843bc0a5c7e81

SHA1
54996c1d4aeaf76855b7b73a323b74c191573863

SHA256
de19d8ea2911ff7e337823576e214151ad4426206db8e9ea9880778f2592f935

SHA512
4b4d5b7707071b86cb2d55411766bb3ebde9a8765becdaf5840d78be6e278f5b3d2bbe2888350a4d113c49a65c9b8e2ec818429db91c72529b0fbfd12f9c7dbe

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5
ec692bde91ad1c6e182843bc0a5c7e81

SHA1
54996c1d4aeaf76855b7b73a323b74c191573863

SHA256
de19d8ea2911ff7e337823576e214151ad4426206db8e9ea9880778f2592f935

SHA512
4b4d5b7707071b86cb2d55411766bb3ebde9a8765becdaf5840d78be6e278f5b3d2bbe2888350a4d113c49a65c9b8e2ec818429db91c72529b0fbfd12f9c7dbe

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5
ec692bde91ad1c6e182843bc0a5c7e81

SHA1
54996c1d4aeaf76855b7b73a323b74c191573863

SHA256
de19d8ea2911ff7e337823576e214151ad4426206db8e9ea9880778f2592f935

SHA512
4b4d5b7707071b86cb2d55411766bb3ebde9a8765becdaf5840d78be6e278f5b3d2bbe2888350a4d113c49a65c9b8e2ec818429db91c72529b0fbfd12f9c7dbe

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5
ec692bde91ad1c6e182843bc0a5c7e81

SHA1
54996c1d4aeaf76855b7b73a323b74c191573863

SHA256
de19d8ea2911ff7e337823576e214151ad4426206db8e9ea9880778f2592f935

SHA512
4b4d5b7707071b86cb2d55411766bb3ebde9a8765becdaf5840d78be6e278f5b3d2bbe2888350a4d113c49a65c9b8e2ec818429db91c72529b0fbfd12f9c7dbe

Download Submit
memory/1072-62-0x00000000036A0000-0x00000000036A2000-memory.dmp

Filesize
8KB

Download
memory/1072-64-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1072-60-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download
memory/1432-77-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1432-70-0x0000000000000000-mapping.dmp

Download
memory/1516-66-0x0000000000000000-mapping.dmp

Download
memory/1516-76-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1564-74-0x0000000000000000-mapping.dmp

Download
memory/1564-78-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1924-65-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1924-63-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads