Analysis
-
max time kernel
5s -
max time network
10s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-04-2024 18:38
General
-
Target
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe
-
Size
658KB
-
MD5
3c41b88825ed5288001a0840f638bb15
-
SHA1
f12e5059fa029c6eea893ab2e6745922d0d89570
-
SHA256
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
-
SHA512
bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h5:KZ1xuVVjfFoynPaVBUR8f+kN10EBT
Malware Config
Extracted
darkcomet
Guest16
sussysdfffdfff343.duckdns.org:1604
DC_MUTEX-6F4SERN
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
mKaVRbcLZnA8
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Google Handler
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3436 attrib.exe 420 attrib.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1484 msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Handler = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Handler = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSecurityPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeTakeOwnershipPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeLoadDriverPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemProfilePrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemtimePrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeProfSingleProcessPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeIncBasePriorityPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeCreatePagefilePrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeBackupPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeRestorePrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeShutdownPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeDebugPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemEnvironmentPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeChangeNotifyPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeRemoteShutdownPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeUndockPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeManageVolumePrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeImpersonatePrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeCreateGlobalPrivilege 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 33 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 34 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 35 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 36 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeIncreaseQuotaPrivilege 1484 msdcsc.exe Token: SeSecurityPrivilege 1484 msdcsc.exe Token: SeTakeOwnershipPrivilege 1484 msdcsc.exe Token: SeLoadDriverPrivilege 1484 msdcsc.exe Token: SeSystemProfilePrivilege 1484 msdcsc.exe Token: SeSystemtimePrivilege 1484 msdcsc.exe Token: SeProfSingleProcessPrivilege 1484 msdcsc.exe Token: SeIncBasePriorityPrivilege 1484 msdcsc.exe Token: SeCreatePagefilePrivilege 1484 msdcsc.exe Token: SeBackupPrivilege 1484 msdcsc.exe Token: SeRestorePrivilege 1484 msdcsc.exe Token: SeShutdownPrivilege 1484 msdcsc.exe Token: SeDebugPrivilege 1484 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1484 msdcsc.exe Token: SeChangeNotifyPrivilege 1484 msdcsc.exe Token: SeRemoteShutdownPrivilege 1484 msdcsc.exe Token: SeUndockPrivilege 1484 msdcsc.exe Token: SeManageVolumePrivilege 1484 msdcsc.exe Token: SeImpersonatePrivilege 1484 msdcsc.exe Token: SeCreateGlobalPrivilege 1484 msdcsc.exe Token: 33 1484 msdcsc.exe Token: 34 1484 msdcsc.exe Token: 35 1484 msdcsc.exe Token: 36 1484 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1484 msdcsc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.execmd.execmd.exemsdcsc.exedescription pid process target process PID 3576 wrote to memory of 3168 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 3576 wrote to memory of 3168 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 3576 wrote to memory of 3168 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 3576 wrote to memory of 4480 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 3576 wrote to memory of 4480 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 3576 wrote to memory of 4480 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 3168 wrote to memory of 3436 3168 cmd.exe attrib.exe PID 3168 wrote to memory of 3436 3168 cmd.exe attrib.exe PID 3168 wrote to memory of 3436 3168 cmd.exe attrib.exe PID 4480 wrote to memory of 420 4480 cmd.exe attrib.exe PID 4480 wrote to memory of 420 4480 cmd.exe attrib.exe PID 4480 wrote to memory of 420 4480 cmd.exe attrib.exe PID 3576 wrote to memory of 1484 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 3576 wrote to memory of 1484 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 3576 wrote to memory of 1484 3576 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 1484 wrote to memory of 4048 1484 msdcsc.exe iexplore.exe PID 1484 wrote to memory of 4048 1484 msdcsc.exe iexplore.exe PID 1484 wrote to memory of 4048 1484 msdcsc.exe iexplore.exe PID 1484 wrote to memory of 4160 1484 msdcsc.exe explorer.exe PID 1484 wrote to memory of 4160 1484 msdcsc.exe explorer.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3436 attrib.exe 420 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe"C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
memory/1484-61-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/3576-0-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/3576-62-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB