Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 10:17
Behavioral task
behavioral1
Sample
23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe
Resource
win7-20241023-en
General
-
Target
23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe
-
Size
252KB
-
MD5
3e2d8dc667ca1f54e598579a058cae50
-
SHA1
7ba1170587bd92871fe5d231f84eb299bd028048
-
SHA256
23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264
-
SHA512
3399b1696380b13a0797d52df7aef51c03e92cba9fb4b12477fa9a5b69adbf258e5d7609369282f36af4e7ccd1a4a2ee96ebfbcb198565bc8afebbbbad64db52
-
SSDEEP
6144:lcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:lcWkbgTYWnYnt/IDYhP
Malware Config
Extracted
darkcomet
Guest16
zadrot077.ddns.net:1604
192.168.1.105:1604
DC_MUTEX-XAPUZP1
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
7Tp31A087dlB
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2424 attrib.exe 396 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe -
Executes dropped EXE 1 IoCs
pid Process 4904 msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe -
resource yara_rule behavioral2/memory/544-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/files/0x000a000000023b7b-6.dat upx behavioral2/memory/4904-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/544-17-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4904-18-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4904-22-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4904-24-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4904-26-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4904-28-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4904-30-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeSecurityPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeTakeOwnershipPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeLoadDriverPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeSystemProfilePrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeSystemtimePrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeProfSingleProcessPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeIncBasePriorityPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeCreatePagefilePrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeBackupPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeRestorePrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeShutdownPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeDebugPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeSystemEnvironmentPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeChangeNotifyPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeRemoteShutdownPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeUndockPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeManageVolumePrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeImpersonatePrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeCreateGlobalPrivilege 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: 33 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: 34 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: 35 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: 36 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe Token: SeIncreaseQuotaPrivilege 4904 msdcsc.exe Token: SeSecurityPrivilege 4904 msdcsc.exe Token: SeTakeOwnershipPrivilege 4904 msdcsc.exe Token: SeLoadDriverPrivilege 4904 msdcsc.exe Token: SeSystemProfilePrivilege 4904 msdcsc.exe Token: SeSystemtimePrivilege 4904 msdcsc.exe Token: SeProfSingleProcessPrivilege 4904 msdcsc.exe Token: SeIncBasePriorityPrivilege 4904 msdcsc.exe Token: SeCreatePagefilePrivilege 4904 msdcsc.exe Token: SeBackupPrivilege 4904 msdcsc.exe Token: SeRestorePrivilege 4904 msdcsc.exe Token: SeShutdownPrivilege 4904 msdcsc.exe Token: SeDebugPrivilege 4904 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4904 msdcsc.exe Token: SeChangeNotifyPrivilege 4904 msdcsc.exe Token: SeRemoteShutdownPrivilege 4904 msdcsc.exe Token: SeUndockPrivilege 4904 msdcsc.exe Token: SeManageVolumePrivilege 4904 msdcsc.exe Token: SeImpersonatePrivilege 4904 msdcsc.exe Token: SeCreateGlobalPrivilege 4904 msdcsc.exe Token: 33 4904 msdcsc.exe Token: 34 4904 msdcsc.exe Token: 35 4904 msdcsc.exe Token: 36 4904 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4904 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 544 wrote to memory of 3792 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 84 PID 544 wrote to memory of 3792 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 84 PID 544 wrote to memory of 3792 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 84 PID 544 wrote to memory of 1796 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 86 PID 544 wrote to memory of 1796 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 86 PID 544 wrote to memory of 1796 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 86 PID 544 wrote to memory of 4904 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 88 PID 544 wrote to memory of 4904 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 88 PID 544 wrote to memory of 4904 544 23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe 88 PID 1796 wrote to memory of 2424 1796 cmd.exe 89 PID 1796 wrote to memory of 2424 1796 cmd.exe 89 PID 1796 wrote to memory of 2424 1796 cmd.exe 89 PID 3792 wrote to memory of 396 3792 cmd.exe 91 PID 3792 wrote to memory of 396 3792 cmd.exe 91 PID 3792 wrote to memory of 396 3792 cmd.exe 91 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 PID 4904 wrote to memory of 3880 4904 msdcsc.exe 90 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2424 attrib.exe 396 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe"C:\Users\Admin\AppData\Local\Temp\23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\23e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264N.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:396
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2424
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:3880
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD53e2d8dc667ca1f54e598579a058cae50
SHA17ba1170587bd92871fe5d231f84eb299bd028048
SHA25623e1ceefaa80c5e560dcfe6dc5f9e02f508a8bf7364c349b716711539c210264
SHA5123399b1696380b13a0797d52df7aef51c03e92cba9fb4b12477fa9a5b69adbf258e5d7609369282f36af4e7ccd1a4a2ee96ebfbcb198565bc8afebbbbad64db52