darkcomet | 89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710

General

Target

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Size

235KB
MD5

c59db4ec885ca9531c44c6a2efc30d6b
SHA1

ba38b0c7a46992d2ae0540a9bc2e89dacd31b834
SHA256

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710
SHA512

9ca82da3e8ec092b0beec4ff5be0d21c7046f0c6a8e24ea3524258242fd9f2e0db4988b1ee742d1428aca29b3e94812829bc1f7530d8ad9b72a84aa6a38800a4

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe

Disables RegEdit via registry modification
evasion
Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2144 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
2144	msdcsc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2144 msdcsc.exe

pid	process
2144	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeSecurityPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeTakeOwnershipPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeLoadDriverPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeSystemProfilePrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeSystemtimePrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeProfSingleProcessPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeIncBasePriorityPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeCreatePagefilePrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeBackupPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeRestorePrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeShutdownPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeDebugPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeSystemEnvironmentPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeChangeNotifyPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeRemoteShutdownPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeUndockPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeManageVolumePrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeImpersonatePrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeCreateGlobalPrivilege	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: 33	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: 34	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: 35	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: 36	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
Token: SeIncreaseQuotaPrivilege	2144	msdcsc.exe
Token: SeSecurityPrivilege	2144	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2144	msdcsc.exe
Token: SeLoadDriverPrivilege	2144	msdcsc.exe
Token: SeSystemProfilePrivilege	2144	msdcsc.exe
Token: SeSystemtimePrivilege	2144	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2144	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2144	msdcsc.exe
Token: SeCreatePagefilePrivilege	2144	msdcsc.exe
Token: SeBackupPrivilege	2144	msdcsc.exe
Token: SeRestorePrivilege	2144	msdcsc.exe
Token: SeShutdownPrivilege	2144	msdcsc.exe
Token: SeDebugPrivilege	2144	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2144	msdcsc.exe
Token: SeChangeNotifyPrivilege	2144	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2144	msdcsc.exe
Token: SeUndockPrivilege	2144	msdcsc.exe
Token: SeManageVolumePrivilege	2144	msdcsc.exe
Token: SeImpersonatePrivilege	2144	msdcsc.exe
Token: SeCreateGlobalPrivilege	2144	msdcsc.exe
Token: 33	2144	msdcsc.exe
Token: 34	2144	msdcsc.exe
Token: 35	2144	msdcsc.exe
Token: 36	2144	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2144 msdcsc.exe

pid	process
2144	msdcsc.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 2000 wrote to memory of 2952	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	cmd.exe
PID 2000 wrote to memory of 2952	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	cmd.exe
PID 2000 wrote to memory of 2952	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	cmd.exe
PID 2000 wrote to memory of 652	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	cmd.exe
PID 2000 wrote to memory of 652	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	cmd.exe
PID 2000 wrote to memory of 652	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	cmd.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2000 wrote to memory of 1752	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	notepad.exe
PID 2952 wrote to memory of 4880	2952	cmd.exe	attrib.exe
PID 2952 wrote to memory of 4880	2952	cmd.exe	attrib.exe
PID 2952 wrote to memory of 4880	2952	cmd.exe	attrib.exe
PID 652 wrote to memory of 2008	652	cmd.exe	attrib.exe
PID 652 wrote to memory of 2008	652	cmd.exe	attrib.exe
PID 652 wrote to memory of 2008	652	cmd.exe	attrib.exe
PID 2000 wrote to memory of 2144	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	msdcsc.exe
PID 2000 wrote to memory of 2144	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	msdcsc.exe
PID 2000 wrote to memory of 2144	2000	89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe	msdcsc.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe
PID 2144 wrote to memory of 3196	2144	msdcsc.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2008 attrib.exe
4880 attrib.exe

pid	process
2008	attrib.exe
4880	attrib.exe

C:\Users\Admin\AppData\Local\Temp\89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe
"C:\Users\Admin\AppData\Local\Temp\89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710.exe" +s +h
3⤵
- Views/modifies file attributes
PID:4880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:2008

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
PID:1752

C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:3196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
Filesize
235KB

MD5
c59db4ec885ca9531c44c6a2efc30d6b

SHA1
ba38b0c7a46992d2ae0540a9bc2e89dacd31b834

SHA256
89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710

SHA512
9ca82da3e8ec092b0beec4ff5be0d21c7046f0c6a8e24ea3524258242fd9f2e0db4988b1ee742d1428aca29b3e94812829bc1f7530d8ad9b72a84aa6a38800a4

Download Submit
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
Filesize
235KB

MD5
c59db4ec885ca9531c44c6a2efc30d6b

SHA1
ba38b0c7a46992d2ae0540a9bc2e89dacd31b834

SHA256
89d15a3ee44dbbd97956a37f4434c5f8e67a1684655b48b2f51375af7ad3e710

SHA512
9ca82da3e8ec092b0beec4ff5be0d21c7046f0c6a8e24ea3524258242fd9f2e0db4988b1ee742d1428aca29b3e94812829bc1f7530d8ad9b72a84aa6a38800a4

Download Submit
memory/652-131-0x0000000000000000-mapping.dmp

Download
memory/1752-132-0x0000000000000000-mapping.dmp

Download
memory/2008-134-0x0000000000000000-mapping.dmp

Download
memory/2144-135-0x0000000000000000-mapping.dmp

Download
memory/2952-130-0x0000000000000000-mapping.dmp

Download
memory/3196-138-0x0000000000000000-mapping.dmp

Download
memory/4880-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads