Analysis
-
max time kernel
160s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 23:22
Behavioral task
behavioral1
Sample
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe
Resource
win7-20240221-en
General
-
Target
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe
-
Size
350KB
-
MD5
7dee9ee8a1f01c84a03eec97edfefa90
-
SHA1
6ca55a33d811d84fedbff9278f2f8918284f5713
-
SHA256
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195
-
SHA512
9efbf52874dcfc2a2c48dfb6894ffc3c4d9d02ca441260968886500cdfddc5e5bab51ff5b79117cb336aaa45f0206bfdfe60a7d8b04733192c9b732462920e22
-
SSDEEP
6144:WMI/jlS4kCwHL76nz9Q3uR5LTYYBIsHHN:WMQlS9Cwr79uLLTvBIY
Malware Config
Extracted
darkcomet
Guest16
10.10.0.100:1604
DC_MUTEX-30LAHYZ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
al7BRWGr7y55
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe -
UPX dump on OEP (original entry point) 11 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-0-0x0000000000400000-0x00000000004EA000-memory.dmp UPX C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe UPX behavioral2/memory/5028-14-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-16-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-19-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-21-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-23-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-25-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-27-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-29-0x0000000000400000-0x00000000004EA000-memory.dmp UPX behavioral2/memory/1396-31-0x0000000000400000-0x00000000004EA000-memory.dmp UPX -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3056 attrib.exe 3128 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1396 msdcsc.exe -
Processes:
resource yara_rule behavioral2/memory/5028-0-0x0000000000400000-0x00000000004EA000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe upx behavioral2/memory/5028-14-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-16-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-19-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-21-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-23-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-25-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-27-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-29-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral2/memory/1396-31-0x0000000000400000-0x00000000004EA000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1396 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeSecurityPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeTakeOwnershipPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeLoadDriverPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeSystemProfilePrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeSystemtimePrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeProfSingleProcessPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeIncBasePriorityPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeCreatePagefilePrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeBackupPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeRestorePrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeShutdownPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeDebugPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeSystemEnvironmentPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeChangeNotifyPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeRemoteShutdownPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeUndockPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeManageVolumePrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeImpersonatePrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeCreateGlobalPrivilege 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: 33 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: 34 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: 35 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: 36 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe Token: SeIncreaseQuotaPrivilege 1396 msdcsc.exe Token: SeSecurityPrivilege 1396 msdcsc.exe Token: SeTakeOwnershipPrivilege 1396 msdcsc.exe Token: SeLoadDriverPrivilege 1396 msdcsc.exe Token: SeSystemProfilePrivilege 1396 msdcsc.exe Token: SeSystemtimePrivilege 1396 msdcsc.exe Token: SeProfSingleProcessPrivilege 1396 msdcsc.exe Token: SeIncBasePriorityPrivilege 1396 msdcsc.exe Token: SeCreatePagefilePrivilege 1396 msdcsc.exe Token: SeBackupPrivilege 1396 msdcsc.exe Token: SeRestorePrivilege 1396 msdcsc.exe Token: SeShutdownPrivilege 1396 msdcsc.exe Token: SeDebugPrivilege 1396 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1396 msdcsc.exe Token: SeChangeNotifyPrivilege 1396 msdcsc.exe Token: SeRemoteShutdownPrivilege 1396 msdcsc.exe Token: SeUndockPrivilege 1396 msdcsc.exe Token: SeManageVolumePrivilege 1396 msdcsc.exe Token: SeImpersonatePrivilege 1396 msdcsc.exe Token: SeCreateGlobalPrivilege 1396 msdcsc.exe Token: 33 1396 msdcsc.exe Token: 34 1396 msdcsc.exe Token: 35 1396 msdcsc.exe Token: 36 1396 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1396 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exemsdcsc.execmd.execmd.exedescription pid process target process PID 5028 wrote to memory of 4804 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe cmd.exe PID 5028 wrote to memory of 4804 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe cmd.exe PID 5028 wrote to memory of 4804 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe cmd.exe PID 5028 wrote to memory of 2384 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe cmd.exe PID 5028 wrote to memory of 2384 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe cmd.exe PID 5028 wrote to memory of 2384 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe cmd.exe PID 5028 wrote to memory of 1396 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe msdcsc.exe PID 5028 wrote to memory of 1396 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe msdcsc.exe PID 5028 wrote to memory of 1396 5028 9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe msdcsc.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 1396 wrote to memory of 4336 1396 msdcsc.exe notepad.exe PID 4804 wrote to memory of 3056 4804 cmd.exe attrib.exe PID 4804 wrote to memory of 3056 4804 cmd.exe attrib.exe PID 4804 wrote to memory of 3056 4804 cmd.exe attrib.exe PID 2384 wrote to memory of 3128 2384 cmd.exe attrib.exe PID 2384 wrote to memory of 3128 2384 cmd.exe attrib.exe PID 2384 wrote to memory of 3128 2384 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3056 attrib.exe 3128 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe"C:\Users\Admin\AppData\Local\Temp\9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\9153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3056 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:4336
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
350KB
MD57dee9ee8a1f01c84a03eec97edfefa90
SHA16ca55a33d811d84fedbff9278f2f8918284f5713
SHA2569153d1a2f2fe00b04462eb405d02754fecba082bcde45799dd1a53c994d75195
SHA5129efbf52874dcfc2a2c48dfb6894ffc3c4d9d02ca441260968886500cdfddc5e5bab51ff5b79117cb336aaa45f0206bfdfe60a7d8b04733192c9b732462920e22
-
memory/1396-25-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1396-31-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1396-29-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1396-16-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1396-17-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/1396-27-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1396-19-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1396-21-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1396-23-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/4336-18-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/5028-0-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/5028-14-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/5028-1-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB