darkcomet | 11e4ec701aa7a97b97d299575dd92097d3ee52b5851afa6588f4e1220785b18d

Analysis

max time kernel
1s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a298d3c6875b0feb8e46237e58770c05.exe
Size 853KB
Sample240107-x9qsmscfck
SHA256 11e4ec701aa7a97b97d299575dd92097d3ee52b5851afa6588f4e1220785b18d
MD5 a298d3c6875b0feb8e46237e58770c05
SHA1 313c0dc74092ecaff11886bd6a46180b060101bc
SHA512 cbaaf8aa8d7607856724d573818b01e8e597e3c0891929163b845d6a8bbcf8afaea1287fbf52b6df98984c3681d31611e945ec9463e4cf3cc450cae00a3bba86
SSDEEP 12288:Ts98A+JZQQvMWFy2r0bDn5CX9yN1EO3/l3jZxfPgSWUiG9OelJ7y5g:498AiRr0bj5CX9ihl3jZtwUiCvJuu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

192.168.0.17:1604

Mutex

DC_MUTEX-VKLVSXN

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
HZ0miCZbzc76
install
true
offline_keylogger
true
persistence
true
reg_key
System32dll

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	a298d3c6875b0feb8e46237e58770c05.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2780	attrib.exe
3932	attrib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32dll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	a298d3c6875b0feb8e46237e58770c05.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 4104	4952	Process not Found	43

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	Process not Found
Token: SeIncreaseQuotaPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeSecurityPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeTakeOwnershipPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeLoadDriverPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeSystemProfilePrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeSystemtimePrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeProfSingleProcessPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeIncBasePriorityPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeCreatePagefilePrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeBackupPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeRestorePrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeShutdownPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeDebugPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeSystemEnvironmentPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeChangeNotifyPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeRemoteShutdownPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeUndockPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeManageVolumePrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeImpersonatePrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: SeCreateGlobalPrivilege	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: 33	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: 34	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: 35	4104	a298d3c6875b0feb8e46237e58770c05.exe
Token: 36	4104	a298d3c6875b0feb8e46237e58770c05.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43
PID 4952 wrote to memory of 4104	4952	Process not Found	43

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3932	attrib.exe
2780	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a298d3c6875b0feb8e46237e58770c05.exe
"C:\Users\Admin\AppData\Local\Temp\a298d3c6875b0feb8e46237e58770c05.exe"
1⤵
PID:4952
- C:\Users\Admin\AppData\Local\Temp\a298d3c6875b0feb8e46237e58770c05.exe
  "C:\Users\Admin\AppData\Local\Temp\a298d3c6875b0feb8e46237e58770c05.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4104

C:\Windows\SysWOW64\notepad.exe
notepad
1⤵
PID:696

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
1⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
1⤵
PID:1800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\a298d3c6875b0feb8e46237e58770c05.exe" +s +h
1⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
1⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3932

C:\Windows\SysWOW64\notepad.exe
notepad
1⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
1⤵
PID:2456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a298d3c6875b0feb8e46237e58770c05.exe" +s +h
1⤵
PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msdcsc.exe

Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Size 25KB
SHA256 8beb846aeb3b0f6e630c368739939a8436f7012946e2ca9c2d6d94e46dc2f088
MD5 97652c49a37daf6164581e3abe2d0683
SHA1 02ceae969bf985c2d2597b01f8d11fb82270f6a7
SHA512 5d377060362fa0eabf1d89dd15ae4e0cadca1976d7afc7a33215c4d34d371926260e90378da84d997e1ee754629be1b7e80b8f28f466da33a6d93772632471d4
SSDEEP 384:1JL2DTdpHlA8Gi/OoAa2un1/9ZuV5tYvWZ8ysUo6NYPfGXAe6BQ7WqhVuAF:b/i/OH01/9ZkUWZ83n6NSfirXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdcsc.exe

Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Size 66KB
SHA256 6dfa7b0a032bb41ebc3077f82bdd3b7beab1cb8fd75f9505c8559ef945333c97
MD5 59c3ceddc669ef7b54af36dfecca78b0
SHA1 0285b12b19f54f7377210a7c4e164fbb45daea1d
SHA512 122f1c2973769d8dace34598808adb7db92b65d667ecc158e52ffa100664e111b4f53a531dbdcbfef2010529cb05021baa7eba8e3ab84060eb3cf0cacbe491fd
SSDEEP 1536:O/O2YUa83n6NAyXae1ORixPU07mkzYN8khfaA4FFKVn:O/O6X6NAeamOQxsWYh8A4rKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdcsc.exe

Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Size 38KB
SHA256 f45ca45a6412babb21e6735169f39cb38c9da4b8d207b93d42d51abbd5c5c381
MD5 9959ddbb1c797cc21e6e7fb842274e32
SHA1 bc99e1da0356dfa589ab717c133838198f61122e
SHA512 ff2f727d88ecc8a4e783186131d76300173485dce18a50e55e42a9d6851db5974d092f5d5e2b6c0f958708ad70ea540ce85aeb21cab5776a9b572b4f2db6f455
SSDEEP 768:b/i/OH01/9ZkUWZ83n6NSfirXaeb5bdw7+WY:O/O2YUa83n6NAyXae1ORY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdcsc.exe

Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Size 65KB
SHA256 68370a40cd4badd1e97b7f452620215c2191d5b953fdd7abb336bb81af11082a
MD5 9a1d926120b60900695c37cc04817b9f
SHA1 c42baf23f35eb8feb93d209c1811d96e64e585d0
SHA512 893a730d2fa4a99ba282cd150702f917466f60c74181c2f807c732f35db793326e01547fa3dd56da8f9e4b5f7c1f73d2229fe9b9dccb00acb274413a4e8ee023
SSDEEP 1536:O/O2YUa83n6NAyXae1ORixPU07mkzYN8khfaA4FFKA:O/O6X6NAeamOQxsWYh8A4rKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/696-88-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/1800-84-0x0000000072FF0000-0x00000000735A1000-memory.dmp

Download

memory/1800-75-0x0000000072FF0000-0x00000000735A1000-memory.dmp

Download

memory/1800-77-0x0000000072FF0000-0x00000000735A1000-memory.dmp

Download

memory/1800-76-0x0000000001880000-0x0000000001890000-memory.dmp

Download

memory/4104-13-0x0000000003120000-0x0000000003121000-memory.dmp

Download

memory/4104-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4104-12-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4104-8-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4104-91-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4104-7-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4796-16-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/4952-11-0x0000000074D40000-0x00000000752F1000-memory.dmp

Download

memory/4952-0-0x0000000074D40000-0x00000000752F1000-memory.dmp

Download

memory/4952-1-0x0000000074D40000-0x00000000752F1000-memory.dmp

Download

memory/4952-2-0x0000000001AC0000-0x0000000001AD0000-memory.dmp

Download

memory/5036-87-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5036-85-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5036-90-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5036-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5036-89-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5036-86-0x0000000002B70000-0x0000000002B71000-memory.dmp

Download

memory/5036-93-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads