darkcomet | 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a

General

Target

5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe
Size

722KB
MD5

806b65a2f241146d01b77369371e59f6
SHA1

f95281954408ad3132235c0baa6f75ae00cd748a
SHA256

5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a
SHA512

5c0152ae672a9557244d960c8838e36e0ccdad7234df1076a621f07d4cea5348d6d982fe41dd1060503baa0d69969913d82119b15e8c89f6641b55d806a7946f

Score

10^/10

darkcomet metasploit guest16 backdoor persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-LDXAQCA

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
uT8Um6D8y43p
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Extracted

Family

metasploit

Version

metasploit_stager

C2

192.168.1.10:1604

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

FB_26D7.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FB_26D7.tmp.exe

Executes dropped EXE 3 IoCs

Processes:

FB_26D7.tmp.exeFB_2A33.tmp.exemsdcsc.exe

pid process

1804 FB_26D7.tmp.exe
2128 FB_2A33.tmp.exe
2896 msdcsc.exe

pid	process
1804	FB_26D7.tmp.exe
2128	FB_2A33.tmp.exe
2896	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

FB_26D7.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FB_26D7.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

FB_26D7.tmp.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1804	FB_26D7.tmp.exe
Token: SeSecurityPrivilege	1804	FB_26D7.tmp.exe
Token: SeTakeOwnershipPrivilege	1804	FB_26D7.tmp.exe
Token: SeLoadDriverPrivilege	1804	FB_26D7.tmp.exe
Token: SeSystemProfilePrivilege	1804	FB_26D7.tmp.exe
Token: SeSystemtimePrivilege	1804	FB_26D7.tmp.exe
Token: SeProfSingleProcessPrivilege	1804	FB_26D7.tmp.exe
Token: SeIncBasePriorityPrivilege	1804	FB_26D7.tmp.exe
Token: SeCreatePagefilePrivilege	1804	FB_26D7.tmp.exe
Token: SeBackupPrivilege	1804	FB_26D7.tmp.exe
Token: SeRestorePrivilege	1804	FB_26D7.tmp.exe
Token: SeShutdownPrivilege	1804	FB_26D7.tmp.exe
Token: SeDebugPrivilege	1804	FB_26D7.tmp.exe
Token: SeSystemEnvironmentPrivilege	1804	FB_26D7.tmp.exe
Token: SeChangeNotifyPrivilege	1804	FB_26D7.tmp.exe
Token: SeRemoteShutdownPrivilege	1804	FB_26D7.tmp.exe
Token: SeUndockPrivilege	1804	FB_26D7.tmp.exe
Token: SeManageVolumePrivilege	1804	FB_26D7.tmp.exe
Token: SeImpersonatePrivilege	1804	FB_26D7.tmp.exe
Token: SeCreateGlobalPrivilege	1804	FB_26D7.tmp.exe
Token: 33	1804	FB_26D7.tmp.exe
Token: 34	1804	FB_26D7.tmp.exe
Token: 35	1804	FB_26D7.tmp.exe
Token: 36	1804	FB_26D7.tmp.exe
Token: SeIncreaseQuotaPrivilege	2896	msdcsc.exe
Token: SeSecurityPrivilege	2896	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2896	msdcsc.exe
Token: SeLoadDriverPrivilege	2896	msdcsc.exe
Token: SeSystemProfilePrivilege	2896	msdcsc.exe
Token: SeSystemtimePrivilege	2896	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2896	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2896	msdcsc.exe
Token: SeCreatePagefilePrivilege	2896	msdcsc.exe
Token: SeBackupPrivilege	2896	msdcsc.exe
Token: SeRestorePrivilege	2896	msdcsc.exe
Token: SeShutdownPrivilege	2896	msdcsc.exe
Token: SeDebugPrivilege	2896	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2896	msdcsc.exe
Token: SeChangeNotifyPrivilege	2896	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2896	msdcsc.exe
Token: SeUndockPrivilege	2896	msdcsc.exe
Token: SeManageVolumePrivilege	2896	msdcsc.exe
Token: SeImpersonatePrivilege	2896	msdcsc.exe
Token: SeCreateGlobalPrivilege	2896	msdcsc.exe
Token: 33	2896	msdcsc.exe
Token: 34	2896	msdcsc.exe
Token: 35	2896	msdcsc.exe
Token: 36	2896	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2896 msdcsc.exe

pid	process
2896	msdcsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exeFB_26D7.tmp.exe

description	pid	process	target process
PID 716 wrote to memory of 1804	716	5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe	FB_26D7.tmp.exe
PID 716 wrote to memory of 1804	716	5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe	FB_26D7.tmp.exe
PID 716 wrote to memory of 1804	716	5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe	FB_26D7.tmp.exe
PID 716 wrote to memory of 2128	716	5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe	FB_2A33.tmp.exe
PID 716 wrote to memory of 2128	716	5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe	FB_2A33.tmp.exe
PID 1804 wrote to memory of 2896	1804	FB_26D7.tmp.exe	msdcsc.exe
PID 1804 wrote to memory of 2896	1804	FB_26D7.tmp.exe	msdcsc.exe
PID 1804 wrote to memory of 2896	1804	FB_26D7.tmp.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe
"C:\Users\Admin\AppData\Local\Temp\5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:716

C:\Users\Admin\AppData\Local\Temp\FB_26D7.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_26D7.tmp.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2896

C:\Users\Admin\AppData\Local\Temp\FB_2A33.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_2A33.tmp.exe"
2⤵
- Executes dropped EXE
PID:2128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FB_26D7.tmp.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_26D7.tmp.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_2A33.tmp.exe
MD5
67298c76c8f12a8c64c6e5c33787f325

SHA1
20333c497bea58883bf94d7957196e10247f88a7

SHA256
ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a

SHA512
b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_2A33.tmp.exe
MD5
67298c76c8f12a8c64c6e5c33787f325

SHA1
20333c497bea58883bf94d7957196e10247f88a7

SHA256
ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a

SHA512
b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
memory/1804-115-0x0000000000000000-mapping.dmp

Download
memory/1804-121-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2128-118-0x0000000000000000-mapping.dmp

Download
memory/2896-122-0x0000000000000000-mapping.dmp

Download
memory/2896-125-0x00000000005F0000-0x000000000073A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads