darkcomet | eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c

General

Target

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe
Size

1.1MB
MD5

3fe1770420f1625c60a395e91b665ea6
SHA1

55a317a2ef7e3e18b94d69bfb86bb25c10a31a7b
SHA256

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c
SHA512

dbafbf8f46d04d3a37b22bbf2bd6c13a3b04fbe5cac7d075cc00cc1befa7db8667497fc048b96ea43286d397ec20fbf5fe35794600bf6099dc9cc6f2d4bfcb62

Score

10^/10

darkcomet sazan evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

adm44.duckdns.org:1604

Mutex

DC_MUTEX-5LRPLCA

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
ADsR0jwEcc6b
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	aa.exe

Executes dropped EXE 2 IoCs

Processes:

aa.exemsdcsc.exe

pid process

672 aa.exe
1836 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
672	aa.exe
1836	msdcsc.exe

Loads dropped DLL 4 IoCs

Processes:

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exeaa.exe

pid	process
1824	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe
1824	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe
672	aa.exe
672	aa.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aa.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

1836 msdcsc.exe

pid	process
1836	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

aa.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	672	aa.exe
Token: SeSecurityPrivilege	672	aa.exe
Token: SeTakeOwnershipPrivilege	672	aa.exe
Token: SeLoadDriverPrivilege	672	aa.exe
Token: SeSystemProfilePrivilege	672	aa.exe
Token: SeSystemtimePrivilege	672	aa.exe
Token: SeProfSingleProcessPrivilege	672	aa.exe
Token: SeIncBasePriorityPrivilege	672	aa.exe
Token: SeCreatePagefilePrivilege	672	aa.exe
Token: SeBackupPrivilege	672	aa.exe
Token: SeRestorePrivilege	672	aa.exe
Token: SeShutdownPrivilege	672	aa.exe
Token: SeDebugPrivilege	672	aa.exe
Token: SeSystemEnvironmentPrivilege	672	aa.exe
Token: SeChangeNotifyPrivilege	672	aa.exe
Token: SeRemoteShutdownPrivilege	672	aa.exe
Token: SeUndockPrivilege	672	aa.exe
Token: SeManageVolumePrivilege	672	aa.exe
Token: SeImpersonatePrivilege	672	aa.exe
Token: SeCreateGlobalPrivilege	672	aa.exe
Token: 33	672	aa.exe
Token: 34	672	aa.exe
Token: 35	672	aa.exe
Token: SeIncreaseQuotaPrivilege	1836	msdcsc.exe
Token: SeSecurityPrivilege	1836	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1836	msdcsc.exe
Token: SeLoadDriverPrivilege	1836	msdcsc.exe
Token: SeSystemProfilePrivilege	1836	msdcsc.exe
Token: SeSystemtimePrivilege	1836	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1836	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1836	msdcsc.exe
Token: SeCreatePagefilePrivilege	1836	msdcsc.exe
Token: SeBackupPrivilege	1836	msdcsc.exe
Token: SeRestorePrivilege	1836	msdcsc.exe
Token: SeShutdownPrivilege	1836	msdcsc.exe
Token: SeDebugPrivilege	1836	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1836	msdcsc.exe
Token: SeChangeNotifyPrivilege	1836	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1836	msdcsc.exe
Token: SeUndockPrivilege	1836	msdcsc.exe
Token: SeManageVolumePrivilege	1836	msdcsc.exe
Token: SeImpersonatePrivilege	1836	msdcsc.exe
Token: SeCreateGlobalPrivilege	1836	msdcsc.exe
Token: 33	1836	msdcsc.exe
Token: 34	1836	msdcsc.exe
Token: 35	1836	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

1836 msdcsc.exe

pid	process
1836	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exeaa.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 1824 wrote to memory of 672	1824	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe	aa.exe
PID 1824 wrote to memory of 672	1824	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe	aa.exe
PID 1824 wrote to memory of 672	1824	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe	aa.exe
PID 1824 wrote to memory of 672	1824	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe	aa.exe
PID 672 wrote to memory of 1596	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1596	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1596	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1596	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1664	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1664	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1664	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1664	672	aa.exe	cmd.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 1664 wrote to memory of 1328	1664	cmd.exe	attrib.exe
PID 1664 wrote to memory of 1328	1664	cmd.exe	attrib.exe
PID 1664 wrote to memory of 1328	1664	cmd.exe	attrib.exe
PID 1664 wrote to memory of 1328	1664	cmd.exe	attrib.exe
PID 1596 wrote to memory of 1036	1596	cmd.exe	attrib.exe
PID 1596 wrote to memory of 1036	1596	cmd.exe	attrib.exe
PID 1596 wrote to memory of 1036	1596	cmd.exe	attrib.exe
PID 1596 wrote to memory of 1036	1596	cmd.exe	attrib.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1840	672	aa.exe	notepad.exe
PID 672 wrote to memory of 1836	672	aa.exe	msdcsc.exe
PID 672 wrote to memory of 1836	672	aa.exe	msdcsc.exe
PID 672 wrote to memory of 1836	672	aa.exe	msdcsc.exe
PID 672 wrote to memory of 1836	672	aa.exe	msdcsc.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe
PID 1836 wrote to memory of 884	1836	msdcsc.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1328 attrib.exe
1036 attrib.exe

pid	process
1328	attrib.exe
1036	attrib.exe

C:\Users\Admin\AppData\Local\Temp\eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe
"C:\Users\Admin\AppData\Local\Temp\eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\aa.exe
"C:\Users\Admin\AppData\Local\Temp\aa.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\aa.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\aa.exe" +s +h
4⤵
- Views/modifies file attributes
PID:1036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Views/modifies file attributes
PID:1328

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1840

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aa.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
\Users\Admin\AppData\Local\Temp\aa.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
\Users\Admin\AppData\Local\Temp\aa.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
memory/672-57-0x0000000000000000-mapping.dmp

Download
memory/672-59-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/884-101-0x0000000000000000-mapping.dmp

Download
memory/1036-72-0x0000000000000000-mapping.dmp

Download
memory/1328-71-0x0000000000000000-mapping.dmp

Download
memory/1596-61-0x0000000000000000-mapping.dmp

Download
memory/1664-62-0x0000000000000000-mapping.dmp

Download
memory/1824-54-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

Filesize
40KB

Download
memory/1836-97-0x0000000000000000-mapping.dmp

Download
memory/1840-63-0x0000000000000000-mapping.dmp

Download
memory/1840-64-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads