Analysis

  • max time kernel
    150s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    11-08-2021 16:13

General

  • Target

    PCS.exe

  • Size

    11.1MB

  • MD5

    96e9564254f0acc6aa656cb56ab0e94d

  • SHA1

    b0d63f3ce6bb82c649cbc7a17df774acbf23477d

  • SHA256

    1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

  • SHA512

    69d05b841c558dfe8f8ad8527e8f9450e68becf50bd0d89e372d8cc8b61770bad6d3a94b22ca858829a613d8c563519d0cc92d13f918274ecacb46799e1103d8

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

onlinebonjour1pt.ddns.net:1605

Mutex

DC_MUTEX-XJRH105

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    TeN3mNbzDY1b

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Microdapt

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs
  • Executes dropped EXE 2 IoCs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • autoit_exe 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCS.exe
    "C:\Users\Admin\AppData\Local\Temp\PCS.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\Temp\PCS.exe
      "C:\Users\Admin\AppData\Local\Temp\PCS.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\PCS.exe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\PCS.exe" +s +h
          4⤵
          • Views/modifies file attributes
          PID:1384
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:340
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Views/modifies file attributes
          PID:1644
      • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
        "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
          "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
          4⤵
          • Modifies security service
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            5⤵
              PID:1212

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Modify Existing Service

    1
    T1031

    Hidden Files and Directories

    2
    T1158

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    5
    T1112

    Disabling Security Tools

    2
    T1089

    Hidden Files and Directories

    2
    T1158

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      MD5

      96e9564254f0acc6aa656cb56ab0e94d

      SHA1

      b0d63f3ce6bb82c649cbc7a17df774acbf23477d

      SHA256

      1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

      SHA512

      69d05b841c558dfe8f8ad8527e8f9450e68becf50bd0d89e372d8cc8b61770bad6d3a94b22ca858829a613d8c563519d0cc92d13f918274ecacb46799e1103d8

    • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      MD5

      96e9564254f0acc6aa656cb56ab0e94d

      SHA1

      b0d63f3ce6bb82c649cbc7a17df774acbf23477d

      SHA256

      1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

      SHA512

      69d05b841c558dfe8f8ad8527e8f9450e68becf50bd0d89e372d8cc8b61770bad6d3a94b22ca858829a613d8c563519d0cc92d13f918274ecacb46799e1103d8

    • C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      MD5

      96e9564254f0acc6aa656cb56ab0e94d

      SHA1

      b0d63f3ce6bb82c649cbc7a17df774acbf23477d

      SHA256

      1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

      SHA512

      69d05b841c558dfe8f8ad8527e8f9450e68becf50bd0d89e372d8cc8b61770bad6d3a94b22ca858829a613d8c563519d0cc92d13f918274ecacb46799e1103d8

    • \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      MD5

      96e9564254f0acc6aa656cb56ab0e94d

      SHA1

      b0d63f3ce6bb82c649cbc7a17df774acbf23477d

      SHA256

      1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

      SHA512

      69d05b841c558dfe8f8ad8527e8f9450e68becf50bd0d89e372d8cc8b61770bad6d3a94b22ca858829a613d8c563519d0cc92d13f918274ecacb46799e1103d8

    • \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      MD5

      96e9564254f0acc6aa656cb56ab0e94d

      SHA1

      b0d63f3ce6bb82c649cbc7a17df774acbf23477d

      SHA256

      1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

      SHA512

      69d05b841c558dfe8f8ad8527e8f9450e68becf50bd0d89e372d8cc8b61770bad6d3a94b22ca858829a613d8c563519d0cc92d13f918274ecacb46799e1103d8

    • memory/340-66-0x0000000000000000-mapping.dmp
    • memory/1004-70-0x0000000000000000-mapping.dmp
    • memory/1212-83-0x0000000000020000-0x0000000000021000-memory.dmp
      Filesize

      4KB

    • memory/1212-81-0x0000000000000000-mapping.dmp
    • memory/1384-68-0x0000000000000000-mapping.dmp
    • memory/1556-63-0x00000000000C0000-0x0000000000172000-memory.dmp
      Filesize

      712KB

    • memory/1556-64-0x0000000000230000-0x0000000000231000-memory.dmp
      Filesize

      4KB

    • memory/1556-61-0x000000000014F888-mapping.dmp
    • memory/1556-60-0x00000000000C0000-0x0000000000172000-memory.dmp
      Filesize

      712KB

    • memory/1644-67-0x0000000000000000-mapping.dmp
    • memory/1704-65-0x0000000000000000-mapping.dmp
    • memory/1852-79-0x00000000000C0000-0x0000000000172000-memory.dmp
      Filesize

      712KB

    • memory/1852-80-0x00000000003E0000-0x00000000003E1000-memory.dmp
      Filesize

      4KB

    • memory/1852-76-0x000000000014F888-mapping.dmp
    • memory/1956-59-0x0000000075DA1000-0x0000000075DA3000-memory.dmp
      Filesize

      8KB