darkcomet | b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6

General

Target

b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe
Size

716KB
MD5

0bb1cb742eaddbad11d9e96993fb23d7
SHA1

07437ed6538dfebb78a0367d002cd9212c68f6f0
SHA256

b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6
SHA512

fc111533d4d6d97c6466e2564c865eb8d6e839cb79f8629feed2a794dfa7c83c096a8be2879e7f8287d5719045eb0751a0776a70583ed1b5ae07f3512ba31613

Score

10^/10

darkcomet metasploit guest16 backdoor persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-LDXAQCA

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
uT8Um6D8y43p
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Extracted

Family

metasploit

Version

metasploit_stager

C2

192.168.1.10:1604

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

FB_2E68.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FB_2E68.tmp.exe

Executes dropped EXE 3 IoCs

Processes:

FB_2E68.tmp.exeFB_334B.tmp.exemsdcsc.exe

pid process

2144 FB_2E68.tmp.exe
3536 FB_334B.tmp.exe
3352 msdcsc.exe

pid	process
2144	FB_2E68.tmp.exe
3536	FB_334B.tmp.exe
3352	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

FB_2E68.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FB_2E68.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

FB_2E68.tmp.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2144	FB_2E68.tmp.exe
Token: SeSecurityPrivilege	2144	FB_2E68.tmp.exe
Token: SeTakeOwnershipPrivilege	2144	FB_2E68.tmp.exe
Token: SeLoadDriverPrivilege	2144	FB_2E68.tmp.exe
Token: SeSystemProfilePrivilege	2144	FB_2E68.tmp.exe
Token: SeSystemtimePrivilege	2144	FB_2E68.tmp.exe
Token: SeProfSingleProcessPrivilege	2144	FB_2E68.tmp.exe
Token: SeIncBasePriorityPrivilege	2144	FB_2E68.tmp.exe
Token: SeCreatePagefilePrivilege	2144	FB_2E68.tmp.exe
Token: SeBackupPrivilege	2144	FB_2E68.tmp.exe
Token: SeRestorePrivilege	2144	FB_2E68.tmp.exe
Token: SeShutdownPrivilege	2144	FB_2E68.tmp.exe
Token: SeDebugPrivilege	2144	FB_2E68.tmp.exe
Token: SeSystemEnvironmentPrivilege	2144	FB_2E68.tmp.exe
Token: SeChangeNotifyPrivilege	2144	FB_2E68.tmp.exe
Token: SeRemoteShutdownPrivilege	2144	FB_2E68.tmp.exe
Token: SeUndockPrivilege	2144	FB_2E68.tmp.exe
Token: SeManageVolumePrivilege	2144	FB_2E68.tmp.exe
Token: SeImpersonatePrivilege	2144	FB_2E68.tmp.exe
Token: SeCreateGlobalPrivilege	2144	FB_2E68.tmp.exe
Token: 33	2144	FB_2E68.tmp.exe
Token: 34	2144	FB_2E68.tmp.exe
Token: 35	2144	FB_2E68.tmp.exe
Token: 36	2144	FB_2E68.tmp.exe
Token: SeIncreaseQuotaPrivilege	3352	msdcsc.exe
Token: SeSecurityPrivilege	3352	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3352	msdcsc.exe
Token: SeLoadDriverPrivilege	3352	msdcsc.exe
Token: SeSystemProfilePrivilege	3352	msdcsc.exe
Token: SeSystemtimePrivilege	3352	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3352	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3352	msdcsc.exe
Token: SeCreatePagefilePrivilege	3352	msdcsc.exe
Token: SeBackupPrivilege	3352	msdcsc.exe
Token: SeRestorePrivilege	3352	msdcsc.exe
Token: SeShutdownPrivilege	3352	msdcsc.exe
Token: SeDebugPrivilege	3352	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3352	msdcsc.exe
Token: SeChangeNotifyPrivilege	3352	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3352	msdcsc.exe
Token: SeUndockPrivilege	3352	msdcsc.exe
Token: SeManageVolumePrivilege	3352	msdcsc.exe
Token: SeImpersonatePrivilege	3352	msdcsc.exe
Token: SeCreateGlobalPrivilege	3352	msdcsc.exe
Token: 33	3352	msdcsc.exe
Token: 34	3352	msdcsc.exe
Token: 35	3352	msdcsc.exe
Token: 36	3352	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

3352 msdcsc.exe

pid	process
3352	msdcsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exeFB_2E68.tmp.exe

description	pid	process	target process
PID 3168 wrote to memory of 2144	3168	b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe	FB_2E68.tmp.exe
PID 3168 wrote to memory of 2144	3168	b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe	FB_2E68.tmp.exe
PID 3168 wrote to memory of 2144	3168	b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe	FB_2E68.tmp.exe
PID 3168 wrote to memory of 3536	3168	b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe	FB_334B.tmp.exe
PID 3168 wrote to memory of 3536	3168	b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe	FB_334B.tmp.exe
PID 2144 wrote to memory of 3352	2144	FB_2E68.tmp.exe	msdcsc.exe
PID 2144 wrote to memory of 3352	2144	FB_2E68.tmp.exe	msdcsc.exe
PID 2144 wrote to memory of 3352	2144	FB_2E68.tmp.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe
"C:\Users\Admin\AppData\Local\Temp\b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Local\Temp\FB_2E68.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_2E68.tmp.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3352

C:\Users\Admin\AppData\Local\Temp\FB_334B.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_334B.tmp.exe"
2⤵
- Executes dropped EXE
PID:3536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FB_2E68.tmp.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_2E68.tmp.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_334B.tmp.exe
MD5
67298c76c8f12a8c64c6e5c33787f325

SHA1
20333c497bea58883bf94d7957196e10247f88a7

SHA256
ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a

SHA512
b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_334B.tmp.exe
MD5
67298c76c8f12a8c64c6e5c33787f325

SHA1
20333c497bea58883bf94d7957196e10247f88a7

SHA256
ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a

SHA512
b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
MD5
151f621261af67737f4cfabb696a673e

SHA1
1fdc0f34d3a7705fbdd4051c2dc62d998b09a025

SHA256
0c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d

SHA512
bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc

Download Submit
memory/2144-115-0x0000000000000000-mapping.dmp

Download
memory/2144-121-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/3352-122-0x0000000000000000-mapping.dmp

Download
memory/3352-125-0x0000000000510000-0x00000000005BE000-memory.dmp

Filesize
696KB

Download
memory/3536-118-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads