darkcomet | 98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575

Analysis

max time kernel
180s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Size 724KB
Sample221014-l1995sadb6
SHA256 98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575
MD5 6c10e408fdf057db3fa5d8f9f585912d
SHA1 54dc100fc6648d9e6f595afbd344a1ab1f4c0e31
SHA512 256f2006f5a5760c86ea0febddef388cc07739570c59576994cafcc0eee94c15c59f8ba17cb78bf7837b336ce1e4ec823975b0177bffd718ca1b90f5bdf5474c
SSDEEP 12288:oFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJk:I3nbWmJVJFwSddIXvfhqbiaxvRxq9G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe

Executes dropped EXE 1 IoCs

pid	Process
2836	msdcsc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1776	PING.EXE
3096	PING.EXE
220	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeSecurityPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeTakeOwnershipPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeLoadDriverPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeSystemProfilePrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeSystemtimePrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeProfSingleProcessPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeIncBasePriorityPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeCreatePagefilePrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeBackupPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeRestorePrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeShutdownPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeDebugPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeSystemEnvironmentPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeChangeNotifyPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeRemoteShutdownPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeUndockPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeManageVolumePrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeImpersonatePrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeCreateGlobalPrivilege	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: 33	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: 34	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: 35	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: 36	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
Token: SeIncreaseQuotaPrivilege	2836	msdcsc.exe
Token: SeSecurityPrivilege	2836	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2836	msdcsc.exe
Token: SeLoadDriverPrivilege	2836	msdcsc.exe
Token: SeSystemProfilePrivilege	2836	msdcsc.exe
Token: SeSystemtimePrivilege	2836	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2836	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2836	msdcsc.exe
Token: SeCreatePagefilePrivilege	2836	msdcsc.exe
Token: SeBackupPrivilege	2836	msdcsc.exe
Token: SeRestorePrivilege	2836	msdcsc.exe
Token: SeShutdownPrivilege	2836	msdcsc.exe
Token: SeDebugPrivilege	2836	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2836	msdcsc.exe
Token: SeChangeNotifyPrivilege	2836	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2836	msdcsc.exe
Token: SeUndockPrivilege	2836	msdcsc.exe
Token: SeManageVolumePrivilege	2836	msdcsc.exe
Token: SeImpersonatePrivilege	2836	msdcsc.exe
Token: SeCreateGlobalPrivilege	2836	msdcsc.exe
Token: 33	2836	msdcsc.exe
Token: 34	2836	msdcsc.exe
Token: 35	2836	msdcsc.exe
Token: 36	2836	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2836	msdcsc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3768	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	82
PID 2820 wrote to memory of 3768	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	82
PID 2820 wrote to memory of 3768	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	82
PID 2820 wrote to memory of 3504	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	84
PID 2820 wrote to memory of 3504	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	84
PID 2820 wrote to memory of 3504	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	84
PID 2820 wrote to memory of 4832	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	86
PID 2820 wrote to memory of 4832	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	86
PID 2820 wrote to memory of 4832	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	86
PID 3504 wrote to memory of 220	3504	cmd.exe	90
PID 3504 wrote to memory of 220	3504	cmd.exe	90
PID 3504 wrote to memory of 220	3504	cmd.exe	90
PID 4832 wrote to memory of 3096	4832	cmd.exe	89
PID 4832 wrote to memory of 3096	4832	cmd.exe	89
PID 4832 wrote to memory of 3096	4832	cmd.exe	89
PID 3768 wrote to memory of 1776	3768	cmd.exe	88
PID 3768 wrote to memory of 1776	3768	cmd.exe	88
PID 3768 wrote to memory of 1776	3768	cmd.exe	88
PID 2820 wrote to memory of 2836	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	91
PID 2820 wrote to memory of 2836	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	91
PID 2820 wrote to memory of 2836	2820	98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe	91
PID 2836 wrote to memory of 2868	2836	msdcsc.exe	92
PID 2836 wrote to memory of 2868	2836	msdcsc.exe	92
PID 2836 wrote to memory of 2868	2836	msdcsc.exe	92
PID 2836 wrote to memory of 392	2836	msdcsc.exe	93
PID 2836 wrote to memory of 392	2836	msdcsc.exe	93

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe
"C:\Users\Admin\AppData\Local\Temp\98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:3096
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2836
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2868
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpcmd.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Size 131B
SHA256 1375668b34d29c9b8b71476c1ed64c2d16ea4448ec9e558f6e1821d24b7196b5
MD5 7354e20f71fdd9fae1ef515657790228
SHA1 977444a16148eb7744d63fb1b06a7a79ed22e009
SHA512 96880492aaef72ce3c20669a15cde13327a437e38dc87f87b204fe0c5247cd5e7d91be9f6b3e1189b9a7e42f2304a1dc27279022f4b42bc5862ed8850aa75408
MD5 SHA1 SHA512

Submit Download

msdcsc.exe

Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Size 724KB
SHA256 98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575
MD5 6c10e408fdf057db3fa5d8f9f585912d
SHA1 54dc100fc6648d9e6f595afbd344a1ab1f4c0e31
SHA512 256f2006f5a5760c86ea0febddef388cc07739570c59576994cafcc0eee94c15c59f8ba17cb78bf7837b336ce1e4ec823975b0177bffd718ca1b90f5bdf5474c
SSDEEP 12288:oFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJk:I3nbWmJVJFwSddIXvfhqbiaxvRxq9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdcsc.exe

Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Size 724KB
SHA256 98ecc7c23bb4b27412f8b4659771dfeb530cc7425f21ea68c3f9df0ea4d18575
MD5 6c10e408fdf057db3fa5d8f9f585912d
SHA1 54dc100fc6648d9e6f595afbd344a1ab1f4c0e31
SHA512 256f2006f5a5760c86ea0febddef388cc07739570c59576994cafcc0eee94c15c59f8ba17cb78bf7837b336ce1e4ec823975b0177bffd718ca1b90f5bdf5474c
SSDEEP 12288:oFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJk:I3nbWmJVJFwSddIXvfhqbiaxvRxq9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads