darkcomet | 1529bd2480155dd41221b9729b08f0a14d718aea591ee7d1b0b9406f5687c606

General

Target

bd5b7d938e9239a63dd3cd7a983f9f55.exe
Size

1.8MB
MD5

bd5b7d938e9239a63dd3cd7a983f9f55
SHA1

615f62ddd511d4c13b9f2765394ddf5977050398
SHA256

1529bd2480155dd41221b9729b08f0a14d718aea591ee7d1b0b9406f5687c606
SHA512

3fca63dd2adc40581e774e229ba70ac91e2566d9d53c742dde1b43fd65299e45b6758b0abfc692e9229d8f7ec62e1bd0c5f611504bbc34f61c42babb91a21f22
SSDEEP

49152:vkwkn9IMHeaHw0dWXPUYsUt0G0bIA4aIXaPCS:8dnVjMX1tt0EA40PC

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

10.10.0.100:1604

Mutex

DC_MUTEX-CK91ZJ9

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Fk5GVHWLTpJu
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

4806.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	4806.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bd5b7d938e9239a63dd3cd7a983f9f55.exe4806.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	bd5b7d938e9239a63dd3cd7a983f9f55.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	4806.exe

Executes dropped EXE 2 IoCs

Processes:

4806.exemsdcsc.exe

pid process

936 4806.exe
4584 msdcsc.exe

pid	process
936	4806.exe
4584	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msdcsc.exe4806.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	4806.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

4584 msdcsc.exe

pid	process
4584	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

4806.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	936	4806.exe
Token: SeSecurityPrivilege	936	4806.exe
Token: SeTakeOwnershipPrivilege	936	4806.exe
Token: SeLoadDriverPrivilege	936	4806.exe
Token: SeSystemProfilePrivilege	936	4806.exe
Token: SeSystemtimePrivilege	936	4806.exe
Token: SeProfSingleProcessPrivilege	936	4806.exe
Token: SeIncBasePriorityPrivilege	936	4806.exe
Token: SeCreatePagefilePrivilege	936	4806.exe
Token: SeBackupPrivilege	936	4806.exe
Token: SeRestorePrivilege	936	4806.exe
Token: SeShutdownPrivilege	936	4806.exe
Token: SeDebugPrivilege	936	4806.exe
Token: SeSystemEnvironmentPrivilege	936	4806.exe
Token: SeChangeNotifyPrivilege	936	4806.exe
Token: SeRemoteShutdownPrivilege	936	4806.exe
Token: SeUndockPrivilege	936	4806.exe
Token: SeManageVolumePrivilege	936	4806.exe
Token: SeImpersonatePrivilege	936	4806.exe
Token: SeCreateGlobalPrivilege	936	4806.exe
Token: 33	936	4806.exe
Token: 34	936	4806.exe
Token: 35	936	4806.exe
Token: 36	936	4806.exe
Token: SeIncreaseQuotaPrivilege	4584	msdcsc.exe
Token: SeSecurityPrivilege	4584	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4584	msdcsc.exe
Token: SeLoadDriverPrivilege	4584	msdcsc.exe
Token: SeSystemProfilePrivilege	4584	msdcsc.exe
Token: SeSystemtimePrivilege	4584	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4584	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4584	msdcsc.exe
Token: SeCreatePagefilePrivilege	4584	msdcsc.exe
Token: SeBackupPrivilege	4584	msdcsc.exe
Token: SeRestorePrivilege	4584	msdcsc.exe
Token: SeShutdownPrivilege	4584	msdcsc.exe
Token: SeDebugPrivilege	4584	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4584	msdcsc.exe
Token: SeChangeNotifyPrivilege	4584	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4584	msdcsc.exe
Token: SeUndockPrivilege	4584	msdcsc.exe
Token: SeManageVolumePrivilege	4584	msdcsc.exe
Token: SeImpersonatePrivilege	4584	msdcsc.exe
Token: SeCreateGlobalPrivilege	4584	msdcsc.exe
Token: 33	4584	msdcsc.exe
Token: 34	4584	msdcsc.exe
Token: 35	4584	msdcsc.exe
Token: 36	4584	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

4584 msdcsc.exe

pid	process
4584	msdcsc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

bd5b7d938e9239a63dd3cd7a983f9f55.exe4806.exemsdcsc.exe

description	pid	process	target process
PID 2436 wrote to memory of 936	2436	bd5b7d938e9239a63dd3cd7a983f9f55.exe	4806.exe
PID 2436 wrote to memory of 936	2436	bd5b7d938e9239a63dd3cd7a983f9f55.exe	4806.exe
PID 2436 wrote to memory of 936	2436	bd5b7d938e9239a63dd3cd7a983f9f55.exe	4806.exe
PID 936 wrote to memory of 4584	936	4806.exe	msdcsc.exe
PID 936 wrote to memory of 4584	936	4806.exe	msdcsc.exe
PID 936 wrote to memory of 4584	936	4806.exe	msdcsc.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe
PID 4584 wrote to memory of 4888	4584	msdcsc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\bd5b7d938e9239a63dd3cd7a983f9f55.exe
"C:\Users\Admin\AppData\Local\Temp\bd5b7d938e9239a63dd3cd7a983f9f55.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\4806\4806.exe
"C:\Users\Admin\AppData\Local\Temp\4806\4806.exe"
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4806\4806.exe
Filesize
758KB

MD5
bdbc8dd1a4626488efa5b470eab5dd75

SHA1
28803f060ece4749d0172b692fd52c35accc8ba5

SHA256
04377f6d0053f0efb4bf482d32d2703f92b5168581f4f01376baa0e702cb1e65

SHA512
dfc6b92ade558f40ce04ebfafe3c8dd82b115122fd5fd4b5341e7411616a19ec0db4e84d79f1cc60faca96379c90d8834f07fb1675fad2ff7ece28e6eedc36f8

Download Submit
memory/936-19-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/936-32-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4584-37-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4584-35-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4584-33-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4584-38-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4584-40-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4584-42-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4584-44-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4584-46-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4584-48-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4888-34-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads