Analysis
-
max time kernel
142s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 19:07
Behavioral task
behavioral1
Sample
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe
Resource
win7-20240215-en
General
-
Target
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe
-
Size
1.1MB
-
MD5
8cae7b7712c8db2a4896e15635953d93
-
SHA1
aa362e6fb974dd0d2e0322d3c9c076c842765823
-
SHA256
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09
-
SHA512
f5f83ab8fd44c08d2c33b3bd8a1197737fdcda03985acdd218f414cfd40359257cf4df3f7c62a8ad435c983fcd9445a45dd9d3fef8d7e3bad521f3493d478e8d
-
SSDEEP
24576:9Z1xuVVjfFoynPaVBUR8f+kN10EdcESg2WfrG31X:HQDgok30bESg9frGX
Malware Config
Extracted
darkcomet
Guest16
46.148.21.34:3128
DC_MUTEX-5NGFKSE
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
5KiVbE9BkMJo
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2888 attrib.exe 2524 attrib.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2692 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exepid process 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeSecurityPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeTakeOwnershipPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeLoadDriverPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeSystemProfilePrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeSystemtimePrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeProfSingleProcessPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeIncBasePriorityPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeCreatePagefilePrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeBackupPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeRestorePrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeShutdownPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeDebugPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeSystemEnvironmentPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeChangeNotifyPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeRemoteShutdownPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeUndockPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeManageVolumePrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeImpersonatePrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeCreateGlobalPrivilege 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: 33 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: 34 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: 35 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe Token: SeIncreaseQuotaPrivilege 2692 msdcsc.exe Token: SeSecurityPrivilege 2692 msdcsc.exe Token: SeTakeOwnershipPrivilege 2692 msdcsc.exe Token: SeLoadDriverPrivilege 2692 msdcsc.exe Token: SeSystemProfilePrivilege 2692 msdcsc.exe Token: SeSystemtimePrivilege 2692 msdcsc.exe Token: SeProfSingleProcessPrivilege 2692 msdcsc.exe Token: SeIncBasePriorityPrivilege 2692 msdcsc.exe Token: SeCreatePagefilePrivilege 2692 msdcsc.exe Token: SeBackupPrivilege 2692 msdcsc.exe Token: SeRestorePrivilege 2692 msdcsc.exe Token: SeShutdownPrivilege 2692 msdcsc.exe Token: SeDebugPrivilege 2692 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2692 msdcsc.exe Token: SeChangeNotifyPrivilege 2692 msdcsc.exe Token: SeRemoteShutdownPrivilege 2692 msdcsc.exe Token: SeUndockPrivilege 2692 msdcsc.exe Token: SeManageVolumePrivilege 2692 msdcsc.exe Token: SeImpersonatePrivilege 2692 msdcsc.exe Token: SeCreateGlobalPrivilege 2692 msdcsc.exe Token: 33 2692 msdcsc.exe Token: 34 2692 msdcsc.exe Token: 35 2692 msdcsc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2604 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2692 msdcsc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.execmd.execmd.exedescription pid process target process PID 2264 wrote to memory of 2244 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2264 wrote to memory of 2244 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2264 wrote to memory of 2244 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2264 wrote to memory of 2244 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2264 wrote to memory of 2856 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2264 wrote to memory of 2856 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2264 wrote to memory of 2856 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2264 wrote to memory of 2856 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe cmd.exe PID 2244 wrote to memory of 2888 2244 cmd.exe attrib.exe PID 2244 wrote to memory of 2888 2244 cmd.exe attrib.exe PID 2244 wrote to memory of 2888 2244 cmd.exe attrib.exe PID 2244 wrote to memory of 2888 2244 cmd.exe attrib.exe PID 2856 wrote to memory of 2524 2856 cmd.exe attrib.exe PID 2856 wrote to memory of 2524 2856 cmd.exe attrib.exe PID 2856 wrote to memory of 2524 2856 cmd.exe attrib.exe PID 2856 wrote to memory of 2524 2856 cmd.exe attrib.exe PID 2264 wrote to memory of 2692 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe msdcsc.exe PID 2264 wrote to memory of 2692 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe msdcsc.exe PID 2264 wrote to memory of 2692 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe msdcsc.exe PID 2264 wrote to memory of 2692 2264 43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe msdcsc.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2888 attrib.exe 2524 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe"C:\Users\Admin\AppData\Local\Temp\43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\43073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2524 -
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2692
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2604
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\I2CL36RV1.JPGFilesize
349KB
MD5b724d87994058973ef092853e41747f9
SHA1270cc27d94ba76b9da08c533b377f680e0e1f52e
SHA256b3cc9d63c3e26a70e373063af7909455b2ebf7475e9007f28f750d8844f413c9
SHA5128a452bf9e2d860c5d538fa88bf43822ac70eaba8124a1225edfe3865deb0fdbfbacb1778af2c07026ea4cb73a9c0e06ae6903834cd72db4b34dd9350de78167c
-
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exeFilesize
384KB
MD545ec50c0a272e0d014085024c939f765
SHA1b218d213604b7c3ca06e7129b9941d7139b12ede
SHA2560d9414a88b19b78214098045ffacd218aad8d79e7ae2d0651f32d8cea278681e
SHA512a1d585a8383c034514c6fae75834632c0343747d8c5aa16d7ff9ae6b7d40c88d979c34e6aab7909133a6dca64615164fa3ba59a969d11db763440d962dd0b1f8
-
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exeFilesize
413KB
MD517a6eeca3b377600ebdd5c161dd91408
SHA1548300aa84df9b306ccd4d007adf60223981a77e
SHA256b8720f9b59241a5519241468b71f97630dba068d8047843c37219892ea7619dd
SHA512e9f8511be5878b736ecfe4ca7ef346cbecbcfbe0af95b3ee73646a7d73b68d4c16c60044b2abce945f8b62ab4d6fbfe279cb20cacda802d032496873b057202a
-
C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exeFilesize
1.1MB
MD58cae7b7712c8db2a4896e15635953d93
SHA1aa362e6fb974dd0d2e0322d3c9c076c842765823
SHA25643073226301eeeb038faa18c034a87a396544f0b7e96d8999a74369a5847cf09
SHA512f5f83ab8fd44c08d2c33b3bd8a1197737fdcda03985acdd218f414cfd40359257cf4df3f7c62a8ad435c983fcd9445a45dd9d3fef8d7e3bad521f3493d478e8d
-
\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exeFilesize
512KB
MD5b60d42ef813853630f88e374e7b3e2aa
SHA1c74ef764ba734dd496e99502110f50d9fc565372
SHA256d19eccf20ebe0957b71f62c9e53c3910c8f7fa225875c34f9d183dc0d738a83c
SHA51264d56508f10a3114b1aed3bea1d636e71ce3e49f5fd5d964a869b7f1ab5a6cdffc1c81965047abf182fa14c6dc398c0227de77c40510348b513affd00beadc6c
-
\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exeFilesize
128KB
MD547c085f29c81066558160ceb768d4a4e
SHA18ba06cabc51dba558a3de3d9e72a2c4f6e47b81d
SHA25621f90bf921d4c178a0edc11fd3b4ad76156db2fa584391cad2d8d24a770821db
SHA5128b993c85695999b25ae6d30839f50ca1697ce28173f5086b047b0c2a314e68c26074af54a0ef2b2852be31433d72e758c08f538105051e8f367dcb469ab66629
-
memory/2264-4-0x0000000002330000-0x0000000002332000-memory.dmpFilesize
8KB
-
memory/2264-18-0x0000000000400000-0x0000000000521000-memory.dmpFilesize
1.1MB
-
memory/2264-0-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2604-6-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/2604-5-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2604-21-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/2692-16-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2692-19-0x0000000000400000-0x0000000000521000-memory.dmpFilesize
1.1MB
-
memory/2692-22-0x0000000000400000-0x0000000000521000-memory.dmpFilesize
1.1MB