darkcomet | 08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f

General

Target

08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Size

235KB
MD5

2c92fa8e43a76c9e0ce8f0bfaabf1c33
SHA1

a094988f5ef3e42f032de97d1770e314ed672502
SHA256

08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f
SHA512

10fbb628fa0ab0bee1e4864b10410ad7b21be6091634e3a93041c912ce14dd96056bfcfcd0cc7e8a44bdbc8f7e72729b9316615bd1e1d8e1cf76827abdddabc0

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

3552 msdcsc.exe

pid	process
3552	msdcsc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msdcsc.exe08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avast = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avast = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeSecurityPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeTakeOwnershipPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeLoadDriverPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeSystemProfilePrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeSystemtimePrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeProfSingleProcessPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeIncBasePriorityPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeCreatePagefilePrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeBackupPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeRestorePrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeShutdownPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeDebugPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeSystemEnvironmentPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeChangeNotifyPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeRemoteShutdownPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeUndockPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeManageVolumePrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeImpersonatePrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeCreateGlobalPrivilege	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: 33	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: 34	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: 35	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: 36	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
Token: SeIncreaseQuotaPrivilege	3552	msdcsc.exe
Token: SeSecurityPrivilege	3552	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3552	msdcsc.exe
Token: SeLoadDriverPrivilege	3552	msdcsc.exe
Token: SeSystemProfilePrivilege	3552	msdcsc.exe
Token: SeSystemtimePrivilege	3552	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3552	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3552	msdcsc.exe
Token: SeCreatePagefilePrivilege	3552	msdcsc.exe
Token: SeBackupPrivilege	3552	msdcsc.exe
Token: SeRestorePrivilege	3552	msdcsc.exe
Token: SeShutdownPrivilege	3552	msdcsc.exe
Token: SeDebugPrivilege	3552	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3552	msdcsc.exe
Token: SeChangeNotifyPrivilege	3552	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3552	msdcsc.exe
Token: SeUndockPrivilege	3552	msdcsc.exe
Token: SeManageVolumePrivilege	3552	msdcsc.exe
Token: SeImpersonatePrivilege	3552	msdcsc.exe
Token: SeCreateGlobalPrivilege	3552	msdcsc.exe
Token: 33	3552	msdcsc.exe
Token: 34	3552	msdcsc.exe
Token: 35	3552	msdcsc.exe
Token: 36	3552	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

3552 msdcsc.exe

pid	process
3552	msdcsc.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exemsdcsc.exe

description	pid	process	target process
PID 1292 wrote to memory of 3552	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe	msdcsc.exe
PID 1292 wrote to memory of 3552	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe	msdcsc.exe
PID 1292 wrote to memory of 3552	1292	08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe	msdcsc.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe
PID 3552 wrote to memory of 2200	3552	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe
"C:\Users\Admin\AppData\Local\Temp\08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3552

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
235KB

MD5
2c92fa8e43a76c9e0ce8f0bfaabf1c33

SHA1
a094988f5ef3e42f032de97d1770e314ed672502

SHA256
08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f

SHA512
10fbb628fa0ab0bee1e4864b10410ad7b21be6091634e3a93041c912ce14dd96056bfcfcd0cc7e8a44bdbc8f7e72729b9316615bd1e1d8e1cf76827abdddabc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
235KB

MD5
2c92fa8e43a76c9e0ce8f0bfaabf1c33

SHA1
a094988f5ef3e42f032de97d1770e314ed672502

SHA256
08aacd7ef1a400cc83e1a3f70c77057d993887b856e65499736bc4959282b79f

SHA512
10fbb628fa0ab0bee1e4864b10410ad7b21be6091634e3a93041c912ce14dd96056bfcfcd0cc7e8a44bdbc8f7e72729b9316615bd1e1d8e1cf76827abdddabc0

Download Submit
memory/2200-133-0x0000000000000000-mapping.dmp

Download
memory/3552-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads