darkcomet | eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c

General

Target

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe
Size

1.1MB
MD5

3fe1770420f1625c60a395e91b665ea6
SHA1

55a317a2ef7e3e18b94d69bfb86bb25c10a31a7b
SHA256

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c
SHA512

dbafbf8f46d04d3a37b22bbf2bd6c13a3b04fbe5cac7d075cc00cc1befa7db8667497fc048b96ea43286d397ec20fbf5fe35794600bf6099dc9cc6f2d4bfcb62

Score

10^/10

darkcomet sazan evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

adm44.duckdns.org:1604

Mutex

DC_MUTEX-5LRPLCA

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
ADsR0jwEcc6b
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	aa.exe

Executes dropped EXE 2 IoCs

Processes:

aa.exemsdcsc.exe

pid process

2156 aa.exe
3552 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
2156	aa.exe
3552	msdcsc.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exeaa.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	aa.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aa.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

aa.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ aa.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

3552 msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	aa.exe

pid	process
3552	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

aa.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2156	aa.exe
Token: SeSecurityPrivilege	2156	aa.exe
Token: SeTakeOwnershipPrivilege	2156	aa.exe
Token: SeLoadDriverPrivilege	2156	aa.exe
Token: SeSystemProfilePrivilege	2156	aa.exe
Token: SeSystemtimePrivilege	2156	aa.exe
Token: SeProfSingleProcessPrivilege	2156	aa.exe
Token: SeIncBasePriorityPrivilege	2156	aa.exe
Token: SeCreatePagefilePrivilege	2156	aa.exe
Token: SeBackupPrivilege	2156	aa.exe
Token: SeRestorePrivilege	2156	aa.exe
Token: SeShutdownPrivilege	2156	aa.exe
Token: SeDebugPrivilege	2156	aa.exe
Token: SeSystemEnvironmentPrivilege	2156	aa.exe
Token: SeChangeNotifyPrivilege	2156	aa.exe
Token: SeRemoteShutdownPrivilege	2156	aa.exe
Token: SeUndockPrivilege	2156	aa.exe
Token: SeManageVolumePrivilege	2156	aa.exe
Token: SeImpersonatePrivilege	2156	aa.exe
Token: SeCreateGlobalPrivilege	2156	aa.exe
Token: 33	2156	aa.exe
Token: 34	2156	aa.exe
Token: 35	2156	aa.exe
Token: 36	2156	aa.exe
Token: SeIncreaseQuotaPrivilege	3552	msdcsc.exe
Token: SeSecurityPrivilege	3552	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3552	msdcsc.exe
Token: SeLoadDriverPrivilege	3552	msdcsc.exe
Token: SeSystemProfilePrivilege	3552	msdcsc.exe
Token: SeSystemtimePrivilege	3552	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3552	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3552	msdcsc.exe
Token: SeCreatePagefilePrivilege	3552	msdcsc.exe
Token: SeBackupPrivilege	3552	msdcsc.exe
Token: SeRestorePrivilege	3552	msdcsc.exe
Token: SeShutdownPrivilege	3552	msdcsc.exe
Token: SeDebugPrivilege	3552	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3552	msdcsc.exe
Token: SeChangeNotifyPrivilege	3552	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3552	msdcsc.exe
Token: SeUndockPrivilege	3552	msdcsc.exe
Token: SeManageVolumePrivilege	3552	msdcsc.exe
Token: SeImpersonatePrivilege	3552	msdcsc.exe
Token: SeCreateGlobalPrivilege	3552	msdcsc.exe
Token: 33	3552	msdcsc.exe
Token: 34	3552	msdcsc.exe
Token: 35	3552	msdcsc.exe
Token: 36	3552	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

3552 msdcsc.exe

pid	process
3552	msdcsc.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exeaa.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 4692 wrote to memory of 2156	4692	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe	aa.exe
PID 4692 wrote to memory of 2156	4692	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe	aa.exe
PID 4692 wrote to memory of 2156	4692	eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe	aa.exe
PID 2156 wrote to memory of 5044	2156	aa.exe	cmd.exe
PID 2156 wrote to memory of 5044	2156	aa.exe	cmd.exe
PID 2156 wrote to memory of 5044	2156	aa.exe	cmd.exe
PID 2156 wrote to memory of 4848	2156	aa.exe	cmd.exe
PID 2156 wrote to memory of 4848	2156	aa.exe	cmd.exe
PID 2156 wrote to memory of 4848	2156	aa.exe	cmd.exe
PID 5044 wrote to memory of 640	5044	cmd.exe	attrib.exe
PID 5044 wrote to memory of 640	5044	cmd.exe	attrib.exe
PID 5044 wrote to memory of 640	5044	cmd.exe	attrib.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 2156 wrote to memory of 3652	2156	aa.exe	notepad.exe
PID 4848 wrote to memory of 4752	4848	cmd.exe	attrib.exe
PID 4848 wrote to memory of 4752	4848	cmd.exe	attrib.exe
PID 4848 wrote to memory of 4752	4848	cmd.exe	attrib.exe
PID 2156 wrote to memory of 3552	2156	aa.exe	msdcsc.exe
PID 2156 wrote to memory of 3552	2156	aa.exe	msdcsc.exe
PID 2156 wrote to memory of 3552	2156	aa.exe	msdcsc.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2188	3552	msdcsc.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

640 attrib.exe
4752 attrib.exe

pid	process
640	attrib.exe
4752	attrib.exe

C:\Users\Admin\AppData\Local\Temp\eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe
"C:\Users\Admin\AppData\Local\Temp\eab3fbe0ffb03366b67145f3e3c49d425c373bdef029ff3602b59e9580285e6c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4692

C:\Users\Admin\AppData\Local\Temp\aa.exe
"C:\Users\Admin\AppData\Local\Temp\aa.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\aa.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\aa.exe" +s +h
4⤵
- Views/modifies file attributes
PID:640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Views/modifies file attributes
PID:4752

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:3652

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aa.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
864KB

MD5
864aba87aed3af2b99ed39b10796f407

SHA1
e66f968111d8bd5fe2cb7fb2e5e0ebb36d5d51bc

SHA256
e52d1bc3cfa5af2157f1f3ef2b04b9f03619696920114eb02b36919c40f0286e

SHA512
ee19af44fe33c4bf8c597853f7443ef49fe6c5899806850346c368e1c74d60fd7dbc3c925be240d2ce6d2c20ff6156263f93a68c0bb28b541c0a5e38235727d8

Download Submit
memory/640-145-0x0000000000000000-mapping.dmp

Download
memory/2156-140-0x0000000000000000-mapping.dmp

Download
memory/2188-151-0x0000000000000000-mapping.dmp

Download
memory/3552-148-0x0000000000000000-mapping.dmp

Download
memory/3652-146-0x0000000000000000-mapping.dmp

Download
memory/4692-139-0x00000000052C0000-0x0000000005316000-memory.dmp

Filesize
344KB

Download
memory/4692-134-0x0000000000750000-0x000000000075A000-memory.dmp

Filesize
40KB

Download
memory/4692-137-0x0000000005220000-0x00000000052B2000-memory.dmp

Filesize
584KB

Download
memory/4692-136-0x00000000057D0000-0x0000000005D74000-memory.dmp

Filesize
5.6MB

Download
memory/4692-135-0x0000000005180000-0x000000000521C000-memory.dmp

Filesize
624KB

Download
memory/4692-138-0x0000000005100000-0x000000000510A000-memory.dmp

Filesize
40KB

Download
memory/4752-147-0x0000000000000000-mapping.dmp

Download
memory/4848-144-0x0000000000000000-mapping.dmp

Download
memory/5044-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads