darkcomet | 475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

General

Target

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Size

349KB
MD5

4ba3b7693391fa5d8326b686692a9f91
SHA1

bfe26b996c5a1176896cbd82ef8044af25042720
SHA256

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f
SHA512

de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Score

10^/10

darkcomet evasion persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

Windows.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	Windows.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Windows.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	Windows.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

Windows.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	Windows.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	iexplore.exe

Disables RegEdit via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

Windows.exe

pid process

1524 Windows.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
1524	Windows.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe	upx
\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe	upx
C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe	upx
C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe	upx

Loads dropped DLL 2 IoCs

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

pid	process
1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exeWindows.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	Windows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Windows.exe

description pid process target process

PID 1524 set thread context of 572 1524 Windows.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1524 set thread context of 572	1524	Windows.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exeWindows.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSecurityPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeTakeOwnershipPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeLoadDriverPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSystemProfilePrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSystemtimePrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeProfSingleProcessPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeIncBasePriorityPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeCreatePagefilePrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeBackupPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeRestorePrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeShutdownPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeDebugPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSystemEnvironmentPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeChangeNotifyPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeRemoteShutdownPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeUndockPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeManageVolumePrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeImpersonatePrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeCreateGlobalPrivilege	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: 33	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: 34	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: 35	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeIncreaseQuotaPrivilege	1524	Windows.exe
Token: SeSecurityPrivilege	1524	Windows.exe
Token: SeTakeOwnershipPrivilege	1524	Windows.exe
Token: SeLoadDriverPrivilege	1524	Windows.exe
Token: SeSystemProfilePrivilege	1524	Windows.exe
Token: SeSystemtimePrivilege	1524	Windows.exe
Token: SeProfSingleProcessPrivilege	1524	Windows.exe
Token: SeIncBasePriorityPrivilege	1524	Windows.exe
Token: SeCreatePagefilePrivilege	1524	Windows.exe
Token: SeBackupPrivilege	1524	Windows.exe
Token: SeRestorePrivilege	1524	Windows.exe
Token: SeShutdownPrivilege	1524	Windows.exe
Token: SeDebugPrivilege	1524	Windows.exe
Token: SeSystemEnvironmentPrivilege	1524	Windows.exe
Token: SeChangeNotifyPrivilege	1524	Windows.exe
Token: SeRemoteShutdownPrivilege	1524	Windows.exe
Token: SeUndockPrivilege	1524	Windows.exe
Token: SeManageVolumePrivilege	1524	Windows.exe
Token: SeImpersonatePrivilege	1524	Windows.exe
Token: SeCreateGlobalPrivilege	1524	Windows.exe
Token: 33	1524	Windows.exe
Token: 34	1524	Windows.exe
Token: 35	1524	Windows.exe
Token: SeIncreaseQuotaPrivilege	572	iexplore.exe
Token: SeSecurityPrivilege	572	iexplore.exe
Token: SeTakeOwnershipPrivilege	572	iexplore.exe
Token: SeLoadDriverPrivilege	572	iexplore.exe
Token: SeSystemProfilePrivilege	572	iexplore.exe
Token: SeSystemtimePrivilege	572	iexplore.exe
Token: SeProfSingleProcessPrivilege	572	iexplore.exe
Token: SeIncBasePriorityPrivilege	572	iexplore.exe
Token: SeCreatePagefilePrivilege	572	iexplore.exe
Token: SeBackupPrivilege	572	iexplore.exe
Token: SeRestorePrivilege	572	iexplore.exe
Token: SeShutdownPrivilege	572	iexplore.exe
Token: SeDebugPrivilege	572	iexplore.exe
Token: SeSystemEnvironmentPrivilege	572	iexplore.exe
Token: SeChangeNotifyPrivilege	572	iexplore.exe
Token: SeRemoteShutdownPrivilege	572	iexplore.exe
Token: SeUndockPrivilege	572	iexplore.exe
Token: SeManageVolumePrivilege	572	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

572 iexplore.exe

pid	process
572	iexplore.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.execmd.execmd.exeWindows.exe

description	pid	process	target process
PID 1044 wrote to memory of 1472	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1044 wrote to memory of 1472	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1044 wrote to memory of 1472	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1044 wrote to memory of 1472	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1044 wrote to memory of 936	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1044 wrote to memory of 936	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1044 wrote to memory of 936	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1044 wrote to memory of 936	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1472 wrote to memory of 1580	1472	cmd.exe	attrib.exe
PID 1472 wrote to memory of 1580	1472	cmd.exe	attrib.exe
PID 1472 wrote to memory of 1580	1472	cmd.exe	attrib.exe
PID 1472 wrote to memory of 1580	1472	cmd.exe	attrib.exe
PID 936 wrote to memory of 1728	936	cmd.exe	attrib.exe
PID 936 wrote to memory of 1728	936	cmd.exe	attrib.exe
PID 936 wrote to memory of 1728	936	cmd.exe	attrib.exe
PID 936 wrote to memory of 1728	936	cmd.exe	attrib.exe
PID 1044 wrote to memory of 1524	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	Windows.exe
PID 1044 wrote to memory of 1524	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	Windows.exe
PID 1044 wrote to memory of 1524	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	Windows.exe
PID 1044 wrote to memory of 1524	1044	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	Windows.exe
PID 1524 wrote to memory of 572	1524	Windows.exe	iexplore.exe
PID 1524 wrote to memory of 572	1524	Windows.exe	iexplore.exe
PID 1524 wrote to memory of 572	1524	Windows.exe	iexplore.exe
PID 1524 wrote to memory of 572	1524	Windows.exe	iexplore.exe
PID 1524 wrote to memory of 572	1524	Windows.exe	iexplore.exe
PID 1524 wrote to memory of 572	1524	Windows.exe	iexplore.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Windows.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	Windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	Windows.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1580 attrib.exe
1728 attrib.exe

pid	process
1580	attrib.exe
1728	attrib.exe

C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
"C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe" +s +h
3⤵
- Views/modifies file attributes
PID:1580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:1728

C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
"C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1524

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Modifies firewall policy service
- Modifies security service
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

2

T1031

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
Filesize
349KB

MD5
4ba3b7693391fa5d8326b686692a9f91

SHA1
bfe26b996c5a1176896cbd82ef8044af25042720

SHA256
475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

SHA512
de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Download Submit
C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
Filesize
349KB

MD5
4ba3b7693391fa5d8326b686692a9f91

SHA1
bfe26b996c5a1176896cbd82ef8044af25042720

SHA256
475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

SHA512
de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Download Submit
\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
Filesize
349KB

MD5
4ba3b7693391fa5d8326b686692a9f91

SHA1
bfe26b996c5a1176896cbd82ef8044af25042720

SHA256
475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

SHA512
de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Download Submit
\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
Filesize
349KB

MD5
4ba3b7693391fa5d8326b686692a9f91

SHA1
bfe26b996c5a1176896cbd82ef8044af25042720

SHA256
475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

SHA512
de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Download Submit
memory/936-56-0x0000000000000000-mapping.dmp

Download
memory/1044-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1472-55-0x0000000000000000-mapping.dmp

Download
memory/1524-61-0x0000000000000000-mapping.dmp

Download
memory/1580-57-0x0000000000000000-mapping.dmp

Download
memory/1728-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads