darkcomet | 475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

General

Target

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Size

349KB
MD5

4ba3b7693391fa5d8326b686692a9f91
SHA1

bfe26b996c5a1176896cbd82ef8044af25042720
SHA256

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f
SHA512

de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Score

10^/10

darkcomet evasion persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

Windows.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	Windows.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	Windows.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Windows.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

Windows.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	Windows.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	iexplore.exe

Disables RegEdit via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

Windows.exe

pid process

1624 Windows.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
1624	Windows.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe	upx
C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exeWindows.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	Windows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\Windows.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Windows.exe

description pid process target process

PID 1624 set thread context of 4920 1624 Windows.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1624 set thread context of 4920	1624	Windows.exe	iexplore.exe

Modifies registry class 1 IoCs

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exeWindows.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSecurityPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeTakeOwnershipPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeLoadDriverPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSystemProfilePrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSystemtimePrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeProfSingleProcessPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeIncBasePriorityPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeCreatePagefilePrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeBackupPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeRestorePrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeShutdownPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeDebugPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeSystemEnvironmentPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeChangeNotifyPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeRemoteShutdownPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeUndockPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeManageVolumePrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeImpersonatePrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeCreateGlobalPrivilege	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: 33	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: 34	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: 35	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: 36	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
Token: SeIncreaseQuotaPrivilege	1624	Windows.exe
Token: SeSecurityPrivilege	1624	Windows.exe
Token: SeTakeOwnershipPrivilege	1624	Windows.exe
Token: SeLoadDriverPrivilege	1624	Windows.exe
Token: SeSystemProfilePrivilege	1624	Windows.exe
Token: SeSystemtimePrivilege	1624	Windows.exe
Token: SeProfSingleProcessPrivilege	1624	Windows.exe
Token: SeIncBasePriorityPrivilege	1624	Windows.exe
Token: SeCreatePagefilePrivilege	1624	Windows.exe
Token: SeBackupPrivilege	1624	Windows.exe
Token: SeRestorePrivilege	1624	Windows.exe
Token: SeShutdownPrivilege	1624	Windows.exe
Token: SeDebugPrivilege	1624	Windows.exe
Token: SeSystemEnvironmentPrivilege	1624	Windows.exe
Token: SeChangeNotifyPrivilege	1624	Windows.exe
Token: SeRemoteShutdownPrivilege	1624	Windows.exe
Token: SeUndockPrivilege	1624	Windows.exe
Token: SeManageVolumePrivilege	1624	Windows.exe
Token: SeImpersonatePrivilege	1624	Windows.exe
Token: SeCreateGlobalPrivilege	1624	Windows.exe
Token: 33	1624	Windows.exe
Token: 34	1624	Windows.exe
Token: 35	1624	Windows.exe
Token: 36	1624	Windows.exe
Token: SeIncreaseQuotaPrivilege	4920	iexplore.exe
Token: SeSecurityPrivilege	4920	iexplore.exe
Token: SeTakeOwnershipPrivilege	4920	iexplore.exe
Token: SeLoadDriverPrivilege	4920	iexplore.exe
Token: SeSystemProfilePrivilege	4920	iexplore.exe
Token: SeSystemtimePrivilege	4920	iexplore.exe
Token: SeProfSingleProcessPrivilege	4920	iexplore.exe
Token: SeIncBasePriorityPrivilege	4920	iexplore.exe
Token: SeCreatePagefilePrivilege	4920	iexplore.exe
Token: SeBackupPrivilege	4920	iexplore.exe
Token: SeRestorePrivilege	4920	iexplore.exe
Token: SeShutdownPrivilege	4920	iexplore.exe
Token: SeDebugPrivilege	4920	iexplore.exe
Token: SeSystemEnvironmentPrivilege	4920	iexplore.exe
Token: SeChangeNotifyPrivilege	4920	iexplore.exe
Token: SeRemoteShutdownPrivilege	4920	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

4920 iexplore.exe

pid	process
4920	iexplore.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.execmd.execmd.exeWindows.exe

description	pid	process	target process
PID 1688 wrote to memory of 3480	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1688 wrote to memory of 3480	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1688 wrote to memory of 3480	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1688 wrote to memory of 3676	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1688 wrote to memory of 3676	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 1688 wrote to memory of 3676	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	cmd.exe
PID 3480 wrote to memory of 2776	3480	cmd.exe	attrib.exe
PID 3480 wrote to memory of 2776	3480	cmd.exe	attrib.exe
PID 3480 wrote to memory of 2776	3480	cmd.exe	attrib.exe
PID 3676 wrote to memory of 2352	3676	cmd.exe	attrib.exe
PID 3676 wrote to memory of 2352	3676	cmd.exe	attrib.exe
PID 3676 wrote to memory of 2352	3676	cmd.exe	attrib.exe
PID 1688 wrote to memory of 1624	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	Windows.exe
PID 1688 wrote to memory of 1624	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	Windows.exe
PID 1688 wrote to memory of 1624	1688	475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe	Windows.exe
PID 1624 wrote to memory of 4920	1624	Windows.exe	iexplore.exe
PID 1624 wrote to memory of 4920	1624	Windows.exe	iexplore.exe
PID 1624 wrote to memory of 4920	1624	Windows.exe	iexplore.exe
PID 1624 wrote to memory of 4920	1624	Windows.exe	iexplore.exe
PID 1624 wrote to memory of 4920	1624	Windows.exe	iexplore.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Windows.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	Windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	Windows.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2776 attrib.exe
2352 attrib.exe

pid	process
2776	attrib.exe
2352	attrib.exe

C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe
"C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f.exe" +s +h
3⤵
- Views/modifies file attributes
PID:2776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:2352

C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
"C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1624

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Modifies firewall policy service
- Modifies security service
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

2

T1031

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
Filesize
349KB

MD5
4ba3b7693391fa5d8326b686692a9f91

SHA1
bfe26b996c5a1176896cbd82ef8044af25042720

SHA256
475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

SHA512
de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Download Submit
C:\Users\Admin\AppData\Roaming\MSDCSC\Windows.exe
Filesize
349KB

MD5
4ba3b7693391fa5d8326b686692a9f91

SHA1
bfe26b996c5a1176896cbd82ef8044af25042720

SHA256
475604a43c345971022ae3da673840556e6a65e9355ca2376cc3b81b65bbce3f

SHA512
de6c30aa11c1cc63947566b5bcbed45dbefce9d9edabadb069b14157bf64d9aad87bcc92e9453f89e7b5b3858a87d41deb7dc3f288db9430aad0e64dfeddeb1d

Download Submit
memory/1624-134-0x0000000000000000-mapping.dmp

Download
memory/2352-133-0x0000000000000000-mapping.dmp

Download
memory/2776-132-0x0000000000000000-mapping.dmp

Download
memory/3480-130-0x0000000000000000-mapping.dmp

Download
memory/3676-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads