darkcomet | dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7

Analysis

max time kernel
133s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Size

788KB
MD5

2fffaee88dcbe7bb3916dc750300621c
SHA1

a3e4c4a09e3da891d9cf7fdb255e5f611283bb44
SHA256

dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7
SHA512

4851dda70172dc079b907376525103c25a6cb08deb116a9cab361cd5afa990c3bc6e7e63df3d50ee38e223ef9efa213bd95f6ce08cb83f1a9a81c75f18ae5f34
SSDEEP

24576:lZ1xuVVjfFoynPaVBUR8f+kN10EBXMxkTG:/QDgok302bTG

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

46.250.2.101:1604

Mutex

DC_MUTEX-HG6V7Q9

Attributes

InstallPath
MSDCSC\windowssystem.exe
gencode
Ax9lEl8tBlee
install
true
offline_keylogger
true
persistence
false
reg_key
windowssystem

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\windowssystem.exe"	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	windowssystem.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	windowssystem.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	windowssystem.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	windowssystem.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	windowssystem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	windowssystem.exe

Executes dropped EXE 1 IoCs

pid	Process
3216	windowssystem.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	windowssystem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	windowssystem.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowssystem = "C:\\Windows\\system32\\MSDCSC\\windowssystem.exe"	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSDCSC\windowssystem.exe	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\windowssystem.exe	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeSecurityPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeTakeOwnershipPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeLoadDriverPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeSystemProfilePrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeSystemtimePrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeProfSingleProcessPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeIncBasePriorityPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeCreatePagefilePrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeBackupPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeRestorePrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeShutdownPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeDebugPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeSystemEnvironmentPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeChangeNotifyPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeRemoteShutdownPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeUndockPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeManageVolumePrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeImpersonatePrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeCreateGlobalPrivilege	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: 33	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: 34	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: 35	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: 36	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
Token: SeIncreaseQuotaPrivilege	3216	windowssystem.exe
Token: SeSecurityPrivilege	3216	windowssystem.exe
Token: SeTakeOwnershipPrivilege	3216	windowssystem.exe
Token: SeLoadDriverPrivilege	3216	windowssystem.exe
Token: SeSystemProfilePrivilege	3216	windowssystem.exe
Token: SeSystemtimePrivilege	3216	windowssystem.exe
Token: SeProfSingleProcessPrivilege	3216	windowssystem.exe
Token: SeIncBasePriorityPrivilege	3216	windowssystem.exe
Token: SeCreatePagefilePrivilege	3216	windowssystem.exe
Token: SeBackupPrivilege	3216	windowssystem.exe
Token: SeRestorePrivilege	3216	windowssystem.exe
Token: SeShutdownPrivilege	3216	windowssystem.exe
Token: SeDebugPrivilege	3216	windowssystem.exe
Token: SeSystemEnvironmentPrivilege	3216	windowssystem.exe
Token: SeChangeNotifyPrivilege	3216	windowssystem.exe
Token: SeRemoteShutdownPrivilege	3216	windowssystem.exe
Token: SeUndockPrivilege	3216	windowssystem.exe
Token: SeManageVolumePrivilege	3216	windowssystem.exe
Token: SeImpersonatePrivilege	3216	windowssystem.exe
Token: SeCreateGlobalPrivilege	3216	windowssystem.exe
Token: 33	3216	windowssystem.exe
Token: 34	3216	windowssystem.exe
Token: 35	3216	windowssystem.exe
Token: 36	3216	windowssystem.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3216	windowssystem.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3216	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe	81
PID 5080 wrote to memory of 3216	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe	81
PID 5080 wrote to memory of 3216	5080	dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe	81

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	windowssystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	windowssystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	windowssystem.exe

C:\Users\Admin\AppData\Local\Temp\dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe
"C:\Users\Admin\AppData\Local\Temp\dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\MSDCSC\windowssystem.exe
  "C:\Windows\system32\MSDCSC\windowssystem.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MSDCSC\windowssystem.exe

Filesize
788KB

MD5
2fffaee88dcbe7bb3916dc750300621c

SHA1
a3e4c4a09e3da891d9cf7fdb255e5f611283bb44

SHA256
dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7

SHA512
4851dda70172dc079b907376525103c25a6cb08deb116a9cab361cd5afa990c3bc6e7e63df3d50ee38e223ef9efa213bd95f6ce08cb83f1a9a81c75f18ae5f34

Download Submit
C:\Windows\SysWOW64\MSDCSC\windowssystem.exe

Filesize
788KB

MD5
2fffaee88dcbe7bb3916dc750300621c

SHA1
a3e4c4a09e3da891d9cf7fdb255e5f611283bb44

SHA256
dafd48ba32f46c2c6b16e6ee8b583d016b52181a5cd0593f19a691388a828eb7

SHA512
4851dda70172dc079b907376525103c25a6cb08deb116a9cab361cd5afa990c3bc6e7e63df3d50ee38e223ef9efa213bd95f6ce08cb83f1a9a81c75f18ae5f34

Download Submit
memory/3216-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads