darkcomet | ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Size 647KB
Sample221011-lae2bafgd2
SHA256 ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7
MD5 6512f6386805edb353801c6f3934e696
SHA1 c9806646f805c637f8b4964dc07ac7db25b4d267
SHA512 2a42dd1b5af49e4e3c49c9bcd9e82e581f65dcbcfc7e9baff946d7f957e57c36e4d3b14691bef9dbe7efd00d1030da1f04c3d9f25503a54f4a3754cc939d8761
SSDEEP 12288:Q8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixe:JUKoN0bUxgGa/pfBHDb+y1HgZk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\msdcsc.exe"	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplore.exe

Executes dropped EXE 1 IoCs

pid	Process
4428	msdcsc.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
4188	attrib.exe
4192	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\msdcsc.exe"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\msdcsc.exe"	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4428 set thread context of 4036	4428	msdcsc.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1424	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4036	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeSecurityPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeTakeOwnershipPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeLoadDriverPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeSystemProfilePrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeSystemtimePrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeProfSingleProcessPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeIncBasePriorityPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeCreatePagefilePrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeBackupPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeRestorePrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeShutdownPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeDebugPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeSystemEnvironmentPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeChangeNotifyPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeRemoteShutdownPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeUndockPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeManageVolumePrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeImpersonatePrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeCreateGlobalPrivilege	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: 33	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: 34	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: 35	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: 36	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
Token: SeIncreaseQuotaPrivilege	4428	msdcsc.exe
Token: SeSecurityPrivilege	4428	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4428	msdcsc.exe
Token: SeLoadDriverPrivilege	4428	msdcsc.exe
Token: SeSystemProfilePrivilege	4428	msdcsc.exe
Token: SeSystemtimePrivilege	4428	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4428	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4428	msdcsc.exe
Token: SeCreatePagefilePrivilege	4428	msdcsc.exe
Token: SeBackupPrivilege	4428	msdcsc.exe
Token: SeRestorePrivilege	4428	msdcsc.exe
Token: SeShutdownPrivilege	4428	msdcsc.exe
Token: SeDebugPrivilege	4428	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4428	msdcsc.exe
Token: SeChangeNotifyPrivilege	4428	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4428	msdcsc.exe
Token: SeUndockPrivilege	4428	msdcsc.exe
Token: SeManageVolumePrivilege	4428	msdcsc.exe
Token: SeImpersonatePrivilege	4428	msdcsc.exe
Token: SeCreateGlobalPrivilege	4428	msdcsc.exe
Token: 33	4428	msdcsc.exe
Token: 34	4428	msdcsc.exe
Token: 35	4428	msdcsc.exe
Token: 36	4428	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	4036	iexplore.exe
Token: SeSecurityPrivilege	4036	iexplore.exe
Token: SeTakeOwnershipPrivilege	4036	iexplore.exe
Token: SeLoadDriverPrivilege	4036	iexplore.exe
Token: SeSystemProfilePrivilege	4036	iexplore.exe
Token: SeSystemtimePrivilege	4036	iexplore.exe
Token: SeProfSingleProcessPrivilege	4036	iexplore.exe
Token: SeIncBasePriorityPrivilege	4036	iexplore.exe
Token: SeCreatePagefilePrivilege	4036	iexplore.exe
Token: SeBackupPrivilege	4036	iexplore.exe
Token: SeRestorePrivilege	4036	iexplore.exe
Token: SeShutdownPrivilege	4036	iexplore.exe
Token: SeDebugPrivilege	4036	iexplore.exe
Token: SeSystemEnvironmentPrivilege	4036	iexplore.exe
Token: SeChangeNotifyPrivilege	4036	iexplore.exe
Token: SeRemoteShutdownPrivilege	4036	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4036	iexplore.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 644	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	81
PID 4996 wrote to memory of 644	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	81
PID 4996 wrote to memory of 644	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	81
PID 4996 wrote to memory of 3632	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	82
PID 4996 wrote to memory of 3632	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	82
PID 4996 wrote to memory of 3632	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	82
PID 4996 wrote to memory of 4628	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	83
PID 4996 wrote to memory of 4628	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	83
PID 4996 wrote to memory of 4628	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	83
PID 644 wrote to memory of 4188	644	cmd.exe	87
PID 644 wrote to memory of 4188	644	cmd.exe	87
PID 644 wrote to memory of 4188	644	cmd.exe	87
PID 3632 wrote to memory of 4192	3632	cmd.exe	88
PID 3632 wrote to memory of 4192	3632	cmd.exe	88
PID 3632 wrote to memory of 4192	3632	cmd.exe	88
PID 4628 wrote to memory of 1424	4628	cmd.exe	89
PID 4628 wrote to memory of 1424	4628	cmd.exe	89
PID 4628 wrote to memory of 1424	4628	cmd.exe	89
PID 4996 wrote to memory of 4428	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	90
PID 4996 wrote to memory of 4428	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	90
PID 4996 wrote to memory of 4428	4996	ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe	90
PID 4428 wrote to memory of 4036	4428	msdcsc.exe	91
PID 4428 wrote to memory of 4036	4428	msdcsc.exe	91
PID 4428 wrote to memory of 4036	4428	msdcsc.exe	91
PID 4428 wrote to memory of 4036	4428	msdcsc.exe	91
PID 4428 wrote to memory of 4036	4428	msdcsc.exe	91

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4188	attrib.exe
4192	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe
"C:\Users\Admin\AppData\Local\Temp\ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - Runs ping.exe
    PID:1424
- C:\ProgramData\Microsoft\Windows\Start Menu\msdcsc.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\msdcsc.exe"
  2⤵
  - Modifies firewall policy service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies firewall policy service
    - Windows security bypass
    - Adds Run key to start application
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msdcsc.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\msdcsc.exe
Size 647KB
SHA256 ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7
MD5 6512f6386805edb353801c6f3934e696
SHA1 c9806646f805c637f8b4964dc07ac7db25b4d267
SHA512 2a42dd1b5af49e4e3c49c9bcd9e82e581f65dcbcfc7e9baff946d7f957e57c36e4d3b14691bef9dbe7efd00d1030da1f04c3d9f25503a54f4a3754cc939d8761
SSDEEP 12288:Q8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixe:JUKoN0bUxgGa/pfBHDb+y1HgZk
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdcsc.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\msdcsc.exe
Size 647KB
SHA256 ba13bf6c4152c842f61ec6ae3db02bad97fd3a99b8b9a912673bf793d48955f7
MD5 6512f6386805edb353801c6f3934e696
SHA1 c9806646f805c637f8b4964dc07ac7db25b4d267
SHA512 2a42dd1b5af49e4e3c49c9bcd9e82e581f65dcbcfc7e9baff946d7f957e57c36e4d3b14691bef9dbe7efd00d1030da1f04c3d9f25503a54f4a3754cc939d8761
SSDEEP 12288:Q8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixe:JUKoN0bUxgGa/pfBHDb+y1HgZk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads