darkcomet | 1529bd2480155dd41221b9729b08f0a14d718aea591ee7d1b0b9406f5687c606

Analysis

max time kernel
148s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd5b7d938e9239a63dd3cd7a983f9f55.exe
Size

1.8MB
MD5

bd5b7d938e9239a63dd3cd7a983f9f55
SHA1

615f62ddd511d4c13b9f2765394ddf5977050398
SHA256

1529bd2480155dd41221b9729b08f0a14d718aea591ee7d1b0b9406f5687c606
SHA512

3fca63dd2adc40581e774e229ba70ac91e2566d9d53c742dde1b43fd65299e45b6758b0abfc692e9229d8f7ec62e1bd0c5f611504bbc34f61c42babb91a21f22
SSDEEP

49152:vkwkn9IMHeaHw0dWXPUYsUt0G0bIA4aIXaPCS:8dnVjMX1tt0EA40PC

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

10.10.0.100:1604

Mutex

DC_MUTEX-CK91ZJ9

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Fk5GVHWLTpJu
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

4806.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	4806.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

4806.exemsdcsc.exe

pid process

2616 4806.exe
2548 msdcsc.exe

pid	process
2616	4806.exe
2548	msdcsc.exe

Loads dropped DLL 7 IoCs

Processes:

bd5b7d938e9239a63dd3cd7a983f9f55.exe4806.exe

pid	process
2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe
2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe
2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe
2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe
2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe
2616	4806.exe
2616	4806.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4806.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	4806.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2548 msdcsc.exe

pid	process
2548	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

4806.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2616	4806.exe
Token: SeSecurityPrivilege	2616	4806.exe
Token: SeTakeOwnershipPrivilege	2616	4806.exe
Token: SeLoadDriverPrivilege	2616	4806.exe
Token: SeSystemProfilePrivilege	2616	4806.exe
Token: SeSystemtimePrivilege	2616	4806.exe
Token: SeProfSingleProcessPrivilege	2616	4806.exe
Token: SeIncBasePriorityPrivilege	2616	4806.exe
Token: SeCreatePagefilePrivilege	2616	4806.exe
Token: SeBackupPrivilege	2616	4806.exe
Token: SeRestorePrivilege	2616	4806.exe
Token: SeShutdownPrivilege	2616	4806.exe
Token: SeDebugPrivilege	2616	4806.exe
Token: SeSystemEnvironmentPrivilege	2616	4806.exe
Token: SeChangeNotifyPrivilege	2616	4806.exe
Token: SeRemoteShutdownPrivilege	2616	4806.exe
Token: SeUndockPrivilege	2616	4806.exe
Token: SeManageVolumePrivilege	2616	4806.exe
Token: SeImpersonatePrivilege	2616	4806.exe
Token: SeCreateGlobalPrivilege	2616	4806.exe
Token: 33	2616	4806.exe
Token: 34	2616	4806.exe
Token: 35	2616	4806.exe
Token: SeIncreaseQuotaPrivilege	2548	msdcsc.exe
Token: SeSecurityPrivilege	2548	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2548	msdcsc.exe
Token: SeLoadDriverPrivilege	2548	msdcsc.exe
Token: SeSystemProfilePrivilege	2548	msdcsc.exe
Token: SeSystemtimePrivilege	2548	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2548	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2548	msdcsc.exe
Token: SeCreatePagefilePrivilege	2548	msdcsc.exe
Token: SeBackupPrivilege	2548	msdcsc.exe
Token: SeRestorePrivilege	2548	msdcsc.exe
Token: SeShutdownPrivilege	2548	msdcsc.exe
Token: SeDebugPrivilege	2548	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2548	msdcsc.exe
Token: SeChangeNotifyPrivilege	2548	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2548	msdcsc.exe
Token: SeUndockPrivilege	2548	msdcsc.exe
Token: SeManageVolumePrivilege	2548	msdcsc.exe
Token: SeImpersonatePrivilege	2548	msdcsc.exe
Token: SeCreateGlobalPrivilege	2548	msdcsc.exe
Token: 33	2548	msdcsc.exe
Token: 34	2548	msdcsc.exe
Token: 35	2548	msdcsc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

bd5b7d938e9239a63dd3cd7a983f9f55.exe4806.exemsdcsc.exe

description	pid	process	target process
PID 2748 wrote to memory of 2616	2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe	4806.exe
PID 2748 wrote to memory of 2616	2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe	4806.exe
PID 2748 wrote to memory of 2616	2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe	4806.exe
PID 2748 wrote to memory of 2616	2748	bd5b7d938e9239a63dd3cd7a983f9f55.exe	4806.exe
PID 2616 wrote to memory of 2548	2616	4806.exe	msdcsc.exe
PID 2616 wrote to memory of 2548	2616	4806.exe	msdcsc.exe
PID 2616 wrote to memory of 2548	2616	4806.exe	msdcsc.exe
PID 2616 wrote to memory of 2548	2616	4806.exe	msdcsc.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe
PID 2548 wrote to memory of 2444	2548	msdcsc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\bd5b7d938e9239a63dd3cd7a983f9f55.exe
"C:\Users\Admin\AppData\Local\Temp\bd5b7d938e9239a63dd3cd7a983f9f55.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Temp\4806\4806.exe
"C:\Users\Admin\AppData\Local\Temp\4806\4806.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:2444

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
218KB

MD5
9d78dc0afeac2a7485724f7edb05d87b

SHA1
df24756d14f6c198efc58b1e510f02952cc7c19a

SHA256
33e2fee545ffea8176835e363bdfb39f70cd34a11f96586ae31465d0d97bb1e6

SHA512
1d1f425f98a91a33cc355d50f86144ad5f6df3ed636be3e19de0dd80785f27c002f557bfc32cdc62bfbf015c04ddd5583941bdb952600e7f99b77378a0c27998

Download Submit
C:\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
112KB

MD5
79468b6c6a3996f5e545bfacd56a0823

SHA1
d5aea762ae480e8adb7263e60fb2adeb56d2d02a

SHA256
0efe828704df66f211a7dfd6e391d5a871f42ec8d60a6ce031cdf734fa7b04d3

SHA512
3163c8374d6fad7aff3a4faf34d1769cb5721c5d32b66d177994a2f81ffff5e53c11f39b9680e4abcf8f571b833b5c9b3ed5950d9043339bd607e64d0537df9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
78KB

MD5
6c166be69c63139e26251d99d06413b7

SHA1
c838a9110ae0932f2a72331db74cb75630aaffc6

SHA256
bce767405fa7984e3c850df63dce6ee34f089b78567aba46e9a1a2b73af89b9e

SHA512
158a598576fc56fe8ed28f434fd14d5b579a96725f0965437466c8c13109b7901596a4e6c628934c9f66af1eebef923ce89261188bd350b96d1e4bd9ef084a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Filesize
305KB

MD5
dcf293013a687612fe67dd9d595deaf3

SHA1
ed075c7b4a58aaac96b5d5ffb4cf3c483b8bf402

SHA256
478704f661897ed054fe7bc2f4962d3f6cf55a930ba392c3301b67b1e34c8b3f

SHA512
2f50a665f04bdbacde41bca981c0ee6461e8c044f75cd537cec93b6825f83f7e4acf7498253bb775de3b268b65ab6941767b065cb693daad34a5a1161884a5d4

Download Submit
\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
758KB

MD5
bdbc8dd1a4626488efa5b470eab5dd75

SHA1
28803f060ece4749d0172b692fd52c35accc8ba5

SHA256
04377f6d0053f0efb4bf482d32d2703f92b5168581f4f01376baa0e702cb1e65

SHA512
dfc6b92ade558f40ce04ebfafe3c8dd82b115122fd5fd4b5341e7411616a19ec0db4e84d79f1cc60faca96379c90d8834f07fb1675fad2ff7ece28e6eedc36f8

Download Submit
\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
427KB

MD5
e3d15d35aa272fa51bccc2526e44c2a3

SHA1
bc2515b27ea7631ea576b18cfa7ddc1ea1db04c2

SHA256
780dcd11a69d6eda44d4279316b03d60cc3f8f2f16a82b524b56627b9c2c34be

SHA512
008d26e8a97de571ee49be24c042d60a3148c3732af81b4dac5693fc75cb7855f58cd2fca26407fe9b28a9cf77c814333804f2080745310b4e263754ca7d67d6

Download Submit
\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
241KB

MD5
459e38621b7aa33680ccc3dcf4f06f6d

SHA1
74c6366de734347cc73d3430704831b5907f9611

SHA256
8c647b996d4d0db0867d141fd91721f868f62c54057841a955eaa9e69dc96ac1

SHA512
9f8892fc6d63ef464dd234caa1c913ac2d3127063ba47af469f9097d9d8f8b5fc4b0ac82a754dca8e139ea48569b2a3cac8e992534a9376580aa79bd457032c1

Download Submit
\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
177KB

MD5
4c685ea820b2aad0c66f9af2f97d990c

SHA1
12c06813ce84d15425fee3fb6a3816997da60ee5

SHA256
2b62d97d2a0bf1ffe16619c4273fc074288b2167f2d05921ae6aedff4332843f

SHA512
36a405e476cadb07b6513bc0acedfcb1dc42baa99e846098bd98188796e8b9e46cc818e0e5d701eb564457725f30f51ad92412965c4a7d64ed4c4ca6c986f8c2

Download Submit
\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
165KB

MD5
be3321b821984ccdf03faa8f3b17b86a

SHA1
b18cba323c91c55d47daccd48d7c03d5349c43e4

SHA256
f13520bd02f7654b2ebbd0540ea58bb2d2ed333a3f0020beee8c60e38755eb3a

SHA512
31d8fbd4ac9789111f5eae2895d814bb1aa3129d926f6612c49b3736853fbfadd055fec8608ca6df47800a453775bd71c8569155114a9502cde0d46290f6fa14

Download Submit
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Filesize
636KB

MD5
2c853dc5bb329866d69a75e3b1cc2bd9

SHA1
4f4dacc8af83b1d2ef40019784aa7cb0cbe3c42e

SHA256
f33810a810d21fc70768960874a5bc8e3d437d15f5cc55420e0238c7985271b2

SHA512
90260a26c2de6900479946c6db0efab6a800c478d0d471dca7faad88fb492f37c019d040b51f35d5d59cf725f7374c5546b07b0c75077b6b192ef5341eef2c24

Download Submit
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Filesize
339KB

MD5
90c5e7701d634fef3728135d2794b2fa

SHA1
eb8d720abea0ad883dd70448100adc5590555274

SHA256
cc0d1e23a032e112c6f9eeb83ada204777d684ae4b4d71759c7df05f32b7437f

SHA512
ae27925f5e035da3758d1a688478668ea9c8e17c90cc877755886d1c7ad13467e0a14b08dce795aa0e410416fb281f8d97b912e4b757f9fa79ced3c12deeda1c

Download Submit
memory/2444-39-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2548-38-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2548-47-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2548-49-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2616-25-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2616-37-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads