darkcomet | 32c5cdbbd37c34c5d38ceed5bbf657f74b2629596e8b8635e8e888bb51117a0e

General

Target

FivemFreeUpdated.exe
Size

756KB
MD5

507d6f31d2798d62caf36db241b42421
SHA1

f0ac3a0f5c1edc91cf78d713400a0d3a0aba5844
SHA256

32c5cdbbd37c34c5d38ceed5bbf657f74b2629596e8b8635e8e888bb51117a0e
SHA512

ae39793b5312fffea3a68684bffb3800a6dd7cb2327e9da0470cfb05fa4e1a7457ec394da9c7ccea2ec44a01a05fddacc14f4430ba0d63e9766d32d4e2c8d270
SSDEEP

12288:Q9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h5i:0Z1xuVVjfFoynPaVBUR8f+kN10EBO

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

fivemexternal.ddns.net:5529

Mutex

DC_MUTEX-RULX6G9

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
qMSWXMpj99bp
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

FivemFreeUpdated.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FivemFreeUpdated.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

3696 msdcsc.exe

pid	process
3696	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

FivemFreeUpdated.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	FivemFreeUpdated.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

FivemFreeUpdated.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	FivemFreeUpdated.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

FivemFreeUpdated.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3704	FivemFreeUpdated.exe
Token: SeSecurityPrivilege	3704	FivemFreeUpdated.exe
Token: SeTakeOwnershipPrivilege	3704	FivemFreeUpdated.exe
Token: SeLoadDriverPrivilege	3704	FivemFreeUpdated.exe
Token: SeSystemProfilePrivilege	3704	FivemFreeUpdated.exe
Token: SeSystemtimePrivilege	3704	FivemFreeUpdated.exe
Token: SeProfSingleProcessPrivilege	3704	FivemFreeUpdated.exe
Token: SeIncBasePriorityPrivilege	3704	FivemFreeUpdated.exe
Token: SeCreatePagefilePrivilege	3704	FivemFreeUpdated.exe
Token: SeBackupPrivilege	3704	FivemFreeUpdated.exe
Token: SeRestorePrivilege	3704	FivemFreeUpdated.exe
Token: SeShutdownPrivilege	3704	FivemFreeUpdated.exe
Token: SeDebugPrivilege	3704	FivemFreeUpdated.exe
Token: SeSystemEnvironmentPrivilege	3704	FivemFreeUpdated.exe
Token: SeChangeNotifyPrivilege	3704	FivemFreeUpdated.exe
Token: SeRemoteShutdownPrivilege	3704	FivemFreeUpdated.exe
Token: SeUndockPrivilege	3704	FivemFreeUpdated.exe
Token: SeManageVolumePrivilege	3704	FivemFreeUpdated.exe
Token: SeImpersonatePrivilege	3704	FivemFreeUpdated.exe
Token: SeCreateGlobalPrivilege	3704	FivemFreeUpdated.exe
Token: 33	3704	FivemFreeUpdated.exe
Token: 34	3704	FivemFreeUpdated.exe
Token: 35	3704	FivemFreeUpdated.exe
Token: 36	3704	FivemFreeUpdated.exe
Token: SeIncreaseQuotaPrivilege	3696	msdcsc.exe
Token: SeSecurityPrivilege	3696	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3696	msdcsc.exe
Token: SeLoadDriverPrivilege	3696	msdcsc.exe
Token: SeSystemProfilePrivilege	3696	msdcsc.exe
Token: SeSystemtimePrivilege	3696	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3696	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3696	msdcsc.exe
Token: SeCreatePagefilePrivilege	3696	msdcsc.exe
Token: SeBackupPrivilege	3696	msdcsc.exe
Token: SeRestorePrivilege	3696	msdcsc.exe
Token: SeShutdownPrivilege	3696	msdcsc.exe
Token: SeDebugPrivilege	3696	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3696	msdcsc.exe
Token: SeChangeNotifyPrivilege	3696	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3696	msdcsc.exe
Token: SeUndockPrivilege	3696	msdcsc.exe
Token: SeManageVolumePrivilege	3696	msdcsc.exe
Token: SeImpersonatePrivilege	3696	msdcsc.exe
Token: SeCreateGlobalPrivilege	3696	msdcsc.exe
Token: 33	3696	msdcsc.exe
Token: 34	3696	msdcsc.exe
Token: 35	3696	msdcsc.exe
Token: 36	3696	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

3696 msdcsc.exe

pid	process
3696	msdcsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

FivemFreeUpdated.exemsdcsc.exe

description	pid	process	target process
PID 3704 wrote to memory of 3696	3704	FivemFreeUpdated.exe	msdcsc.exe
PID 3704 wrote to memory of 3696	3704	FivemFreeUpdated.exe	msdcsc.exe
PID 3704 wrote to memory of 3696	3704	FivemFreeUpdated.exe	msdcsc.exe
PID 3696 wrote to memory of 776	3696	msdcsc.exe	iexplore.exe
PID 3696 wrote to memory of 776	3696	msdcsc.exe	iexplore.exe
PID 3696 wrote to memory of 776	3696	msdcsc.exe	iexplore.exe
PID 3696 wrote to memory of 1300	3696	msdcsc.exe	explorer.exe
PID 3696 wrote to memory of 1300	3696	msdcsc.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\FivemFreeUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\FivemFreeUpdated.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:776

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
PID:1300

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
756KB

MD5
507d6f31d2798d62caf36db241b42421

SHA1
f0ac3a0f5c1edc91cf78d713400a0d3a0aba5844

SHA256
32c5cdbbd37c34c5d38ceed5bbf657f74b2629596e8b8635e8e888bb51117a0e

SHA512
ae39793b5312fffea3a68684bffb3800a6dd7cb2327e9da0470cfb05fa4e1a7457ec394da9c7ccea2ec44a01a05fddacc14f4430ba0d63e9766d32d4e2c8d270

Download Submit
memory/3696-62-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3696-64-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3696-66-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3704-0-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/3704-63-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads