darkcomet | 27e663cc439cf3ff7b2f66260a851c8cf0ea5292d259bd1c22171685017dbd4c

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a31d59e190008f0a3a2abc334c6ce9f9.exe
Size

828KB
MD5

a31d59e190008f0a3a2abc334c6ce9f9
SHA1

37456e8559512dff814b09f9ca3710517148f8f2
SHA256

27e663cc439cf3ff7b2f66260a851c8cf0ea5292d259bd1c22171685017dbd4c
SHA512

47bdeb93ec8e8b659d3279c43524b4410bb91fc8b96e6f3a8044f189d91269b9e0d3fa236063f2fc05c12cf73777079f6e84f4b935e8122c095e85e525b49d75
SSDEEP

24576:Gqv5LEymyQvPvS8cZTouk1wRhZ2Bq8aChQ:GqBL1AXvA0B1lw8/hQ

Score

10^/10

darkcomet bootkit persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	a31d59e190008f0a3a2abc334c6ce9f9.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	a31d59e190008f0a3a2abc334c6ce9f9.exe

Executes dropped EXE 3 IoCs

pid	Process
4488	msdcsc.exe
1524	msdcsc.exe
3360	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	a31d59e190008f0a3a2abc334c6ce9f9.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	a31d59e190008f0a3a2abc334c6ce9f9.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 4120 set thread context of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4488 set thread context of 1524	4488	msdcsc.exe	100
PID 1524 set thread context of 3360	1524	msdcsc.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeSecurityPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeTakeOwnershipPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeLoadDriverPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeSystemProfilePrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeSystemtimePrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeProfSingleProcessPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeIncBasePriorityPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeCreatePagefilePrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeBackupPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeRestorePrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeShutdownPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeDebugPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeSystemEnvironmentPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeChangeNotifyPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeRemoteShutdownPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeUndockPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeManageVolumePrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeImpersonatePrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeCreateGlobalPrivilege	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: 33	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: 34	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: 35	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: 36	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe
Token: SeIncreaseQuotaPrivilege	3360	msdcsc.exe
Token: SeSecurityPrivilege	3360	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3360	msdcsc.exe
Token: SeLoadDriverPrivilege	3360	msdcsc.exe
Token: SeSystemProfilePrivilege	3360	msdcsc.exe
Token: SeSystemtimePrivilege	3360	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3360	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3360	msdcsc.exe
Token: SeCreatePagefilePrivilege	3360	msdcsc.exe
Token: SeBackupPrivilege	3360	msdcsc.exe
Token: SeRestorePrivilege	3360	msdcsc.exe
Token: SeShutdownPrivilege	3360	msdcsc.exe
Token: SeDebugPrivilege	3360	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3360	msdcsc.exe
Token: SeChangeNotifyPrivilege	3360	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3360	msdcsc.exe
Token: SeUndockPrivilege	3360	msdcsc.exe
Token: SeManageVolumePrivilege	3360	msdcsc.exe
Token: SeImpersonatePrivilege	3360	msdcsc.exe
Token: SeCreateGlobalPrivilege	3360	msdcsc.exe
Token: 33	3360	msdcsc.exe
Token: 34	3360	msdcsc.exe
Token: 35	3360	msdcsc.exe
Token: 36	3360	msdcsc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5048	a31d59e190008f0a3a2abc334c6ce9f9.exe
4120	a31d59e190008f0a3a2abc334c6ce9f9.exe
4488	msdcsc.exe
1524	msdcsc.exe
3360	msdcsc.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 5048 wrote to memory of 4120	5048	a31d59e190008f0a3a2abc334c6ce9f9.exe	92
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4120 wrote to memory of 4156	4120	a31d59e190008f0a3a2abc334c6ce9f9.exe	93
PID 4156 wrote to memory of 4488	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe	94
PID 4156 wrote to memory of 4488	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe	94
PID 4156 wrote to memory of 4488	4156	a31d59e190008f0a3a2abc334c6ce9f9.exe	94
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 4488 wrote to memory of 1524	4488	msdcsc.exe	100
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99
PID 1524 wrote to memory of 3360	1524	msdcsc.exe	99

C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe
"C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe
  "C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe
    "C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1524

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
92KB

MD5
d3af8f9df8885160cc6329de65e34224

SHA1
0f0b6c6ee924c5ed1714a947def2d2e60cccc667

SHA256
141f875f332c20cc90386f9894be244e3c6903a7b1d60561043f21bdb6fb31a5

SHA512
61ccc0d9e77b27214b3a200e1107adcd19c3cafb32839a2b36ef4915a142e785d773823a1b82135cd048cd5597495e8633d023cd7b3fc21f19c2c7631361036f

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
30KB

MD5
e378face4edd2c8ad88e3e691eea204c

SHA1
aa85e35f7adb0386a4fb8fe69d53c955678c10fb

SHA256
cafcc4279c814a25ff7b772b91bcde400cd82c695e1937b949b8a003dbe8681b

SHA512
7523e5af64c2cc57e7b0ee2dbdd3fbfc24c44d3d21c2791a3c1e9f22046dfaf48a290869d472e8ae8655ca6c04d81fa745074181384d99eeb7166e8c7804bd9b

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
59KB

MD5
dec595c615b0d97dc849cf8c74984a5d

SHA1
a6278f2805f925d742b6417baa69f86286a7ac01

SHA256
0274d3be9d655b2c990cbdcdd9efb599cb295f00aad48c8300978df767bf07a6

SHA512
3add55e923ca7e3b1c9efa8d70ec5ead2eec5a9cd74b10e79683d4f6c6b7e3759c1c0812160217521c4626b014993c3452f31ac7e752212fab6dc53a1a2779bd

Download Submit
memory/1524-36-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1524-41-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1524-33-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3360-40-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-48-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-62-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-61-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-60-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-59-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-58-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-47-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-46-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-45-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-44-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/3360-43-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-57-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-56-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-55-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-54-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-49-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-50-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-51-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-52-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3360-53-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4120-9-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4120-2-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4120-4-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4156-7-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4156-13-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/4156-12-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4156-11-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4156-8-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4156-26-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads