darkcomet | 9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a

Analysis

max time kernel
73s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe
Size

952KB
MD5

1b23fab35973b7f02afe4820582ef78a
SHA1

a2cf2ab66f58a456b137e5371b718e1f12cf78f5
SHA256

9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a
SHA512

2c491aeeaab19d3fcc324cd367c399c3dd7608c3dbd9693e76bbbdc7f6732018f80d7f6286cceb41dbdc6c978e335c6d96609d0d05b8a9715070abd0f8e75a74
SSDEEP

24576:dzIw8LgLA5I7w6Zr8EocfBIbg/qqrUjLA:WMLnEYly90

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

ultr4fucker.no-ip.org:1604

ultr4fucker.no-ip.org:1602

Mutex

DC_MUTEX-XSXR7S6

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
5t77d8EWQtDn
install
true
offline_keylogger
true
persistence
true
reg_key
svchost

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
432	svchost.exe
1052	msdcsc.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
1060	attrib.exe
1108	attrib.exe

Loads dropped DLL 2 IoCs

pid	Process
2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe
432	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\12334 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12334.exe"	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	432	svchost.exe
Token: SeSecurityPrivilege	432	svchost.exe
Token: SeTakeOwnershipPrivilege	432	svchost.exe
Token: SeLoadDriverPrivilege	432	svchost.exe
Token: SeSystemProfilePrivilege	432	svchost.exe
Token: SeSystemtimePrivilege	432	svchost.exe
Token: SeProfSingleProcessPrivilege	432	svchost.exe
Token: SeIncBasePriorityPrivilege	432	svchost.exe
Token: SeCreatePagefilePrivilege	432	svchost.exe
Token: SeBackupPrivilege	432	svchost.exe
Token: SeRestorePrivilege	432	svchost.exe
Token: SeShutdownPrivilege	432	svchost.exe
Token: SeDebugPrivilege	432	svchost.exe
Token: SeSystemEnvironmentPrivilege	432	svchost.exe
Token: SeChangeNotifyPrivilege	432	svchost.exe
Token: SeRemoteShutdownPrivilege	432	svchost.exe
Token: SeUndockPrivilege	432	svchost.exe
Token: SeManageVolumePrivilege	432	svchost.exe
Token: SeImpersonatePrivilege	432	svchost.exe
Token: SeCreateGlobalPrivilege	432	svchost.exe
Token: 33	432	svchost.exe
Token: 34	432	svchost.exe
Token: 35	432	svchost.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 2040 wrote to memory of 432	2040	9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe	28
PID 432 wrote to memory of 1392	432	svchost.exe	29
PID 432 wrote to memory of 1392	432	svchost.exe	29
PID 432 wrote to memory of 1392	432	svchost.exe	29
PID 432 wrote to memory of 1392	432	svchost.exe	29
PID 432 wrote to memory of 1688	432	svchost.exe	31
PID 432 wrote to memory of 1688	432	svchost.exe	31
PID 432 wrote to memory of 1688	432	svchost.exe	31
PID 432 wrote to memory of 1688	432	svchost.exe	31
PID 1688 wrote to memory of 1060	1688	cmd.exe	34
PID 1688 wrote to memory of 1060	1688	cmd.exe	34
PID 1688 wrote to memory of 1060	1688	cmd.exe	34
PID 1688 wrote to memory of 1060	1688	cmd.exe	34
PID 1392 wrote to memory of 1108	1392	cmd.exe	35
PID 1392 wrote to memory of 1108	1392	cmd.exe	35
PID 1392 wrote to memory of 1108	1392	cmd.exe	35
PID 1392 wrote to memory of 1108	1392	cmd.exe	35
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1532	432	svchost.exe	33
PID 432 wrote to memory of 1052	432	svchost.exe	36
PID 432 wrote to memory of 1052	432	svchost.exe	36
PID 432 wrote to memory of 1052	432	svchost.exe	36
PID 432 wrote to memory of 1052	432	svchost.exe	36

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1060	attrib.exe
1108	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe
"C:\Users\Admin\AppData\Local\Temp\9033eb8237373f29ab501f3d705e4d6368c2655c9b8fb2122bdb93d141519f9a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\App\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\App\svchost.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\App\svchost.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\App\svchost.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\App" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\App" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1060
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
    "C:\Windows\system32\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\App\svchost.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\App\svchost.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\App\svchost.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/432-63-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-59-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-67-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-65-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-68-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-72-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-73-0x000000000048F888-mapping.dmp

Download
memory/432-61-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-75-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-77-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-58-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/432-85-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1052-88-0x0000000000000000-mapping.dmp

Download
memory/1060-81-0x0000000000000000-mapping.dmp

Download
memory/1108-82-0x0000000000000000-mapping.dmp

Download
memory/1392-79-0x0000000000000000-mapping.dmp

Download
memory/1532-83-0x0000000000000000-mapping.dmp

Download
memory/1688-80-0x0000000000000000-mapping.dmp

Download
memory/2040-86-0x0000000000A96000-0x0000000000AA7000-memory.dmp

Filesize
68KB

Download
memory/2040-54-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-55-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads