darkcomet | c3a6fa449ef70565a6b5eba1deb4bf069098d9e6dd4706937a9df4418bc08b07

Analysis

max time kernel
111s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fnfree.exe
Size

2.5MB
MD5

6ba1a478a0e5f61d6394aba252c1a13b
SHA1

caa8705c38084facd231914cc9adf72ad26f74aa
SHA256

c3a6fa449ef70565a6b5eba1deb4bf069098d9e6dd4706937a9df4418bc08b07
SHA512

e9c7d2fef0b52ee949fa378143d48c9f52c1f94426109b21a2452ca8d579343788e6592ab3eaf046d5604bc3132637c12457088a65a0e0cbf644be08bbff2091
SSDEEP

49152:mQDgok30M5ROmcDQEOrQ+FTKKioIRh9UXEKJWl4yNP6grg:mQU/JbglOkwTKHPjUEKJWh13rg

Score

10^/10

darkcomet cap evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Cap

91.93.172.78:1604

Mutex

DC_MUTEX-CG4P2XS

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
to2DGe4wqYwK
install
true
offline_keylogger
true
persistence
true
reg_key
Runtime Broker

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

fnfree.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	fnfree.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
1956	attrib.exe
4108	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fnfree.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	fnfree.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid	Process
8	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fnfree.exemsdcsc.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	fnfree.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in System32 directory 3 IoCs

Processes:

fnfree.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	fnfree.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	fnfree.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	fnfree.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 7 IoCs

Processes:

taskmgr.exefnfree.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings	fnfree.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fnfree.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid	Process
3564	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid	Process
3564	vlc.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

fnfree.exemsdcsc.exeAUDIODG.EXEvlc.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4356	fnfree.exe
Token: SeSecurityPrivilege	4356	fnfree.exe
Token: SeTakeOwnershipPrivilege	4356	fnfree.exe
Token: SeLoadDriverPrivilege	4356	fnfree.exe
Token: SeSystemProfilePrivilege	4356	fnfree.exe
Token: SeSystemtimePrivilege	4356	fnfree.exe
Token: SeProfSingleProcessPrivilege	4356	fnfree.exe
Token: SeIncBasePriorityPrivilege	4356	fnfree.exe
Token: SeCreatePagefilePrivilege	4356	fnfree.exe
Token: SeBackupPrivilege	4356	fnfree.exe
Token: SeRestorePrivilege	4356	fnfree.exe
Token: SeShutdownPrivilege	4356	fnfree.exe
Token: SeDebugPrivilege	4356	fnfree.exe
Token: SeSystemEnvironmentPrivilege	4356	fnfree.exe
Token: SeChangeNotifyPrivilege	4356	fnfree.exe
Token: SeRemoteShutdownPrivilege	4356	fnfree.exe
Token: SeUndockPrivilege	4356	fnfree.exe
Token: SeManageVolumePrivilege	4356	fnfree.exe
Token: SeImpersonatePrivilege	4356	fnfree.exe
Token: SeCreateGlobalPrivilege	4356	fnfree.exe
Token: 33	4356	fnfree.exe
Token: 34	4356	fnfree.exe
Token: 35	4356	fnfree.exe
Token: 36	4356	fnfree.exe
Token: SeIncreaseQuotaPrivilege	8	msdcsc.exe
Token: SeSecurityPrivilege	8	msdcsc.exe
Token: SeTakeOwnershipPrivilege	8	msdcsc.exe
Token: SeLoadDriverPrivilege	8	msdcsc.exe
Token: SeSystemProfilePrivilege	8	msdcsc.exe
Token: SeSystemtimePrivilege	8	msdcsc.exe
Token: SeProfSingleProcessPrivilege	8	msdcsc.exe
Token: SeIncBasePriorityPrivilege	8	msdcsc.exe
Token: SeCreatePagefilePrivilege	8	msdcsc.exe
Token: SeBackupPrivilege	8	msdcsc.exe
Token: SeRestorePrivilege	8	msdcsc.exe
Token: SeShutdownPrivilege	8	msdcsc.exe
Token: SeDebugPrivilege	8	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	8	msdcsc.exe
Token: SeChangeNotifyPrivilege	8	msdcsc.exe
Token: SeRemoteShutdownPrivilege	8	msdcsc.exe
Token: SeUndockPrivilege	8	msdcsc.exe
Token: SeManageVolumePrivilege	8	msdcsc.exe
Token: SeImpersonatePrivilege	8	msdcsc.exe
Token: SeCreateGlobalPrivilege	8	msdcsc.exe
Token: 33	8	msdcsc.exe
Token: 34	8	msdcsc.exe
Token: 35	8	msdcsc.exe
Token: 36	8	msdcsc.exe
Token: 33	2264	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2264	AUDIODG.EXE
Token: 33	3564	vlc.exe
Token: SeIncBasePriorityPrivilege	3564	vlc.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

vlc.exe

pid	Process
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

vlc.exe

pid	Process
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe
3564	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vlc.exemsdcsc.exe

pid	Process
3564	vlc.exe
8	msdcsc.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

fnfree.execmd.execmd.exemsdcsc.exe

description	pid	Process	procid_target
PID 4356 wrote to memory of 3008	4356	fnfree.exe	100
PID 4356 wrote to memory of 3008	4356	fnfree.exe	100
PID 4356 wrote to memory of 3008	4356	fnfree.exe	100
PID 4356 wrote to memory of 4640	4356	fnfree.exe	102
PID 4356 wrote to memory of 4640	4356	fnfree.exe	102
PID 4356 wrote to memory of 4640	4356	fnfree.exe	102
PID 3008 wrote to memory of 1956	3008	cmd.exe	104
PID 3008 wrote to memory of 1956	3008	cmd.exe	104
PID 3008 wrote to memory of 1956	3008	cmd.exe	104
PID 4640 wrote to memory of 4108	4640	cmd.exe	106
PID 4640 wrote to memory of 4108	4640	cmd.exe	106
PID 4640 wrote to memory of 4108	4640	cmd.exe	106
PID 4356 wrote to memory of 3564	4356	fnfree.exe	105
PID 4356 wrote to memory of 3564	4356	fnfree.exe	105
PID 4356 wrote to memory of 8	4356	fnfree.exe	107
PID 4356 wrote to memory of 8	4356	fnfree.exe	107
PID 4356 wrote to memory of 8	4356	fnfree.exe	107
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109
PID 8 wrote to memory of 1352	8	msdcsc.exe	109

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
1956	attrib.exe
4108	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fnfree.exe
"C:\Users\Admin\AppData\Local\Temp\fnfree.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\fnfree.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\fnfree.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4108
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\UNRARELYLOL.WAV"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3564
- C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
  "C:\Windows\system32\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
PID:3948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UNRARELYLOL.WAV

Filesize
1.8MB

MD5
cf9a94b3dd9d22d501789789b1076a46

SHA1
60c76b8b3731e9094106cb9fbf2e1f3a644c050b

SHA256
247a70fa86cbad1bc05681e64d0de186f41220fcf64ebc9af90720ba6a79b08c

SHA512
40cf25b62c183940816ab10b8b47660371011b833c5a9b66ff5461eb26920c19e2d6e383056449e9d7b673c7725b34900ad6348ac9d985be0913d489bd8b0dcf

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe

Filesize
2.5MB

MD5
6ba1a478a0e5f61d6394aba252c1a13b

SHA1
caa8705c38084facd231914cc9adf72ad26f74aa

SHA256
c3a6fa449ef70565a6b5eba1deb4bf069098d9e6dd4706937a9df4418bc08b07

SHA512
e9c7d2fef0b52ee949fa378143d48c9f52c1f94426109b21a2452ca8d579343788e6592ab3eaf046d5604bc3132637c12457088a65a0e0cbf644be08bbff2091

Download Submit
memory/8-96-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/8-121-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/8-119-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/8-117-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/8-114-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/8-113-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/1352-69-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/3564-95-0x00007FFE31650000-0x00007FFE31661000-memory.dmp

Filesize
68KB

Download
memory/3564-86-0x00007FFE31770000-0x00007FFE3178D000-memory.dmp

Filesize
116KB

Download
memory/3564-85-0x00007FFE31790000-0x00007FFE317A1000-memory.dmp

Filesize
68KB

Download
memory/3564-84-0x00007FFE36EA0000-0x00007FFE36EB7000-memory.dmp

Filesize
92KB

Download
memory/3564-83-0x00007FFE3FA10000-0x00007FFE3FA21000-memory.dmp

Filesize
68KB

Download
memory/3564-82-0x00007FFE3FA30000-0x00007FFE3FA47000-memory.dmp

Filesize
92KB

Download
memory/3564-81-0x00007FFE3FB20000-0x00007FFE3FB38000-memory.dmp

Filesize
96KB

Download
memory/3564-78-0x00007FF6E8320000-0x00007FF6E8418000-memory.dmp

Filesize
992KB

Download
memory/3564-94-0x00007FFE31670000-0x00007FFE31681000-memory.dmp

Filesize
68KB

Download
memory/3564-89-0x00007FFE2DF80000-0x00007FFE2F030000-memory.dmp

Filesize
16.7MB

Download
memory/3564-88-0x00007FFE2FC50000-0x00007FFE2FE5B000-memory.dmp

Filesize
2.0MB

Download
memory/3564-93-0x00007FFE31690000-0x00007FFE316A1000-memory.dmp

Filesize
68KB

Download
memory/3564-92-0x00007FFE316B0000-0x00007FFE316C8000-memory.dmp

Filesize
96KB

Download
memory/3564-91-0x00007FFE316D0000-0x00007FFE316F1000-memory.dmp

Filesize
132KB

Download
memory/3564-90-0x00007FFE31700000-0x00007FFE31741000-memory.dmp

Filesize
260KB

Download
memory/3564-109-0x00007FFE2FE60000-0x00007FFE30116000-memory.dmp

Filesize
2.7MB

Download
memory/3564-108-0x00007FFE3FB40000-0x00007FFE3FB74000-memory.dmp

Filesize
208KB

Download
memory/3564-107-0x00007FF6E8320000-0x00007FF6E8418000-memory.dmp

Filesize
992KB

Download
memory/3564-110-0x00007FFE2DF80000-0x00007FFE2F030000-memory.dmp

Filesize
16.7MB

Download
memory/3564-80-0x00007FFE2FE60000-0x00007FFE30116000-memory.dmp

Filesize
2.7MB

Download
memory/3564-87-0x00007FFE31750000-0x00007FFE31761000-memory.dmp

Filesize
68KB

Download
memory/3564-79-0x00007FFE3FB40000-0x00007FFE3FB74000-memory.dmp

Filesize
208KB

Download
memory/3948-118-0x0000021B22BD0000-0x0000021B22D24000-memory.dmp

Filesize
1.3MB

Download
memory/4356-0-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4356-75-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download