darkcomet | 18e1d4a98fba8563fe525e6a739811a73e8bb2aeb149bd27185dddcf4e1acf0b

Analysis

max time kernel
98s
max time network
102s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperV1.24.exe
Size

1.4MB
MD5

f930308eca6abad4f340bb4f7497cbe9
SHA1

a785c5b157c4ac9e6355fd4037b5815bd012d3a5
SHA256

18e1d4a98fba8563fe525e6a739811a73e8bb2aeb149bd27185dddcf4e1acf0b
SHA512

2fa502615cc662ac0b0df085f371244fe7566292549fed1f23b0fb830fe3b9cda0cb931c81ae8e9b63818f59ab214a4abd06b2e3829265dd424477d578529e51
SSDEEP

24576:+Z1xuVVjfFoynPaVBUR8f+kN10EBJp5vgHWjTwAlocaKjyyItHDzZ:eQDgok30srLocaKjGD

Score

10^/10

darkcomet robox discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Robox

tm6bqni.localto.net:1511

Mutex

DC_MUTEX-Y4ZY6S9

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
zoY9mkixxMwi
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	BootstrapperV1.24.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2832	attrib.exe
2864	attrib.exe

Deletes itself 1 IoCs

pid	Process
2840	notepad.exe

Executes dropped EXE 3 IoCs

pid	Process
2912	BOOTSTRAPPERV1.22.EXE
1512	msdcsc.exe
1372	Process not Found

Loads dropped DLL 9 IoCs

pid	Process
1592	BootstrapperV1.24.exe
2956	Process not Found
1592	BootstrapperV1.24.exe
1592	BootstrapperV1.24.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	BootstrapperV1.24.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV1.24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2104	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1512	msdcsc.exe
1512	msdcsc.exe
1512	msdcsc.exe
1512	msdcsc.exe
1512	msdcsc.exe
1512	msdcsc.exe
1512	msdcsc.exe
1512	msdcsc.exe
1512	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1592	BootstrapperV1.24.exe
Token: SeSecurityPrivilege	1592	BootstrapperV1.24.exe
Token: SeTakeOwnershipPrivilege	1592	BootstrapperV1.24.exe
Token: SeLoadDriverPrivilege	1592	BootstrapperV1.24.exe
Token: SeSystemProfilePrivilege	1592	BootstrapperV1.24.exe
Token: SeSystemtimePrivilege	1592	BootstrapperV1.24.exe
Token: SeProfSingleProcessPrivilege	1592	BootstrapperV1.24.exe
Token: SeIncBasePriorityPrivilege	1592	BootstrapperV1.24.exe
Token: SeCreatePagefilePrivilege	1592	BootstrapperV1.24.exe
Token: SeBackupPrivilege	1592	BootstrapperV1.24.exe
Token: SeRestorePrivilege	1592	BootstrapperV1.24.exe
Token: SeShutdownPrivilege	1592	BootstrapperV1.24.exe
Token: SeDebugPrivilege	1592	BootstrapperV1.24.exe
Token: SeSystemEnvironmentPrivilege	1592	BootstrapperV1.24.exe
Token: SeChangeNotifyPrivilege	1592	BootstrapperV1.24.exe
Token: SeRemoteShutdownPrivilege	1592	BootstrapperV1.24.exe
Token: SeUndockPrivilege	1592	BootstrapperV1.24.exe
Token: SeManageVolumePrivilege	1592	BootstrapperV1.24.exe
Token: SeImpersonatePrivilege	1592	BootstrapperV1.24.exe
Token: SeCreateGlobalPrivilege	1592	BootstrapperV1.24.exe
Token: 33	1592	BootstrapperV1.24.exe
Token: 34	1592	BootstrapperV1.24.exe
Token: 35	1592	BootstrapperV1.24.exe
Token: SeIncreaseQuotaPrivilege	1512	msdcsc.exe
Token: SeSecurityPrivilege	1512	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1512	msdcsc.exe
Token: SeLoadDriverPrivilege	1512	msdcsc.exe
Token: SeSystemProfilePrivilege	1512	msdcsc.exe
Token: SeSystemtimePrivilege	1512	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1512	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1512	msdcsc.exe
Token: SeCreatePagefilePrivilege	1512	msdcsc.exe
Token: SeBackupPrivilege	1512	msdcsc.exe
Token: SeRestorePrivilege	1512	msdcsc.exe
Token: SeShutdownPrivilege	1512	msdcsc.exe
Token: SeDebugPrivilege	1512	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1512	msdcsc.exe
Token: SeChangeNotifyPrivilege	1512	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1512	msdcsc.exe
Token: SeUndockPrivilege	1512	msdcsc.exe
Token: SeManageVolumePrivilege	1512	msdcsc.exe
Token: SeImpersonatePrivilege	1512	msdcsc.exe
Token: SeCreateGlobalPrivilege	1512	msdcsc.exe
Token: 33	1512	msdcsc.exe
Token: 34	1512	msdcsc.exe
Token: 35	1512	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	2060	WMIC.exe
Token: SeSecurityPrivilege	2060	WMIC.exe
Token: SeTakeOwnershipPrivilege	2060	WMIC.exe
Token: SeLoadDriverPrivilege	2060	WMIC.exe
Token: SeSystemProfilePrivilege	2060	WMIC.exe
Token: SeSystemtimePrivilege	2060	WMIC.exe
Token: SeProfSingleProcessPrivilege	2060	WMIC.exe
Token: SeIncBasePriorityPrivilege	2060	WMIC.exe
Token: SeCreatePagefilePrivilege	2060	WMIC.exe
Token: SeBackupPrivilege	2060	WMIC.exe
Token: SeRestorePrivilege	2060	WMIC.exe
Token: SeShutdownPrivilege	2060	WMIC.exe
Token: SeDebugPrivilege	2060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2060	WMIC.exe
Token: SeRemoteShutdownPrivilege	2060	WMIC.exe
Token: SeUndockPrivilege	2060	WMIC.exe
Token: SeManageVolumePrivilege	2060	WMIC.exe
Token: 33	2060	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2324	1592	BootstrapperV1.24.exe	30
PID 1592 wrote to memory of 2324	1592	BootstrapperV1.24.exe	30
PID 1592 wrote to memory of 2324	1592	BootstrapperV1.24.exe	30
PID 1592 wrote to memory of 2324	1592	BootstrapperV1.24.exe	30
PID 1592 wrote to memory of 2064	1592	BootstrapperV1.24.exe	32
PID 1592 wrote to memory of 2064	1592	BootstrapperV1.24.exe	32
PID 1592 wrote to memory of 2064	1592	BootstrapperV1.24.exe	32
PID 1592 wrote to memory of 2064	1592	BootstrapperV1.24.exe	32
PID 1592 wrote to memory of 2912	1592	BootstrapperV1.24.exe	34
PID 1592 wrote to memory of 2912	1592	BootstrapperV1.24.exe	34
PID 1592 wrote to memory of 2912	1592	BootstrapperV1.24.exe	34
PID 1592 wrote to memory of 2912	1592	BootstrapperV1.24.exe	34
PID 2064 wrote to memory of 2864	2064	cmd.exe	36
PID 2064 wrote to memory of 2864	2064	cmd.exe	36
PID 2064 wrote to memory of 2864	2064	cmd.exe	36
PID 2064 wrote to memory of 2864	2064	cmd.exe	36
PID 2324 wrote to memory of 2832	2324	cmd.exe	37
PID 2324 wrote to memory of 2832	2324	cmd.exe	37
PID 2324 wrote to memory of 2832	2324	cmd.exe	37
PID 2324 wrote to memory of 2832	2324	cmd.exe	37
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 2840	1592	BootstrapperV1.24.exe	38
PID 1592 wrote to memory of 1512	1592	BootstrapperV1.24.exe	39
PID 1592 wrote to memory of 1512	1592	BootstrapperV1.24.exe	39
PID 1592 wrote to memory of 1512	1592	BootstrapperV1.24.exe	39
PID 1592 wrote to memory of 1512	1592	BootstrapperV1.24.exe	39
PID 1512 wrote to memory of 2476	1512	msdcsc.exe	40
PID 1512 wrote to memory of 2476	1512	msdcsc.exe	40
PID 1512 wrote to memory of 2476	1512	msdcsc.exe	40
PID 1512 wrote to memory of 2476	1512	msdcsc.exe	40
PID 1512 wrote to memory of 2456	1512	msdcsc.exe	41
PID 1512 wrote to memory of 2456	1512	msdcsc.exe	41
PID 1512 wrote to memory of 2456	1512	msdcsc.exe	41
PID 1512 wrote to memory of 2456	1512	msdcsc.exe	41
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42
PID 1512 wrote to memory of 1640	1512	msdcsc.exe	42

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2832	attrib.exe
2864	attrib.exe

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.24.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.24.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.24.exe" +s +h
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.24.exe" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2864
- C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.22.EXE
  "C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.22.EXE"
  2⤵
  - Executes dropped EXE
  PID:2912
- - C:\Windows\system32\cmd.exe
    "cmd" /c ipconfig /all
    3⤵
    PID:3040
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2104
- - C:\Windows\system32\cmd.exe
    "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    PID:1216
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2912 -s 1156
    3⤵
    - Loads dropped DLL
    PID:2132
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2840
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2476
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
1.4MB

MD5
f930308eca6abad4f340bb4f7497cbe9

SHA1
a785c5b157c4ac9e6355fd4037b5815bd012d3a5

SHA256
18e1d4a98fba8563fe525e6a739811a73e8bb2aeb149bd27185dddcf4e1acf0b

SHA512
2fa502615cc662ac0b0df085f371244fe7566292549fed1f23b0fb830fe3b9cda0cb931c81ae8e9b63818f59ab214a4abd06b2e3829265dd424477d578529e51

Download Submit
\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERV1.22.EXE

Filesize
800KB

MD5
2a4dcf20b82896be94eb538260c5fb93

SHA1
21f232c2fd8132f8677e53258562ad98b455e679

SHA256
ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a

SHA512
4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288

Download Submit
memory/1592-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2840-39-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2840-11-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2912-10-0x0000000000ED0000-0x0000000000F9E000-memory.dmp

Filesize
824KB

Download