darkcomet | 099298eb0d27113f15636f07de5e7ab7995d432b928ef22a54e2c204117c4be4

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam Money Exploit.exe
Size

875KB
MD5

2bb231e6b395b212b61e4d9812a96c68
SHA1

64613e8f67107ac12fbde10d3a3e061d93ed8759
SHA256

ca876f0d6b688d44f6cf155996ad3353b200c9cf6951c301a13b8e85f668885e
SHA512

fb722d7a91e4bb6567febda9e1711a22c19644e9758fef40941b1f0fd3817b7e1888fed0189804f4c324182ac8b716b35b05ff78892f74e504be08ca0a8da6d1
SSDEEP

12288:oGWkDv2vfM2Ag6rh4fR0VZmVYDskAk2UNNzwISHpsNo:tWkDeDAgmhYShrHp3

Score

10^/10

darkcomet hacked discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

HackeD

hackos.no-ip.biz:1604

Mutex

DC_MUTEX-W73HHNJ

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
sBdcyo0RLfX2
install
true
offline_keylogger
true
password
koperek
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Steam Money Exploit.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2560	msdcsc.exe
3064	msdcsc.exe

Loads dropped DLL 1 IoCs

pid	Process
2664	Steam Money Exploit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Steam Money Exploit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2664	2736	Steam Money Exploit.exe	30
PID 2560 set thread context of 3064	2560	msdcsc.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam Money Exploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam Money Exploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2664	Steam Money Exploit.exe
Token: SeSecurityPrivilege	2664	Steam Money Exploit.exe
Token: SeTakeOwnershipPrivilege	2664	Steam Money Exploit.exe
Token: SeLoadDriverPrivilege	2664	Steam Money Exploit.exe
Token: SeSystemProfilePrivilege	2664	Steam Money Exploit.exe
Token: SeSystemtimePrivilege	2664	Steam Money Exploit.exe
Token: SeProfSingleProcessPrivilege	2664	Steam Money Exploit.exe
Token: SeIncBasePriorityPrivilege	2664	Steam Money Exploit.exe
Token: SeCreatePagefilePrivilege	2664	Steam Money Exploit.exe
Token: SeBackupPrivilege	2664	Steam Money Exploit.exe
Token: SeRestorePrivilege	2664	Steam Money Exploit.exe
Token: SeShutdownPrivilege	2664	Steam Money Exploit.exe
Token: SeDebugPrivilege	2664	Steam Money Exploit.exe
Token: SeSystemEnvironmentPrivilege	2664	Steam Money Exploit.exe
Token: SeChangeNotifyPrivilege	2664	Steam Money Exploit.exe
Token: SeRemoteShutdownPrivilege	2664	Steam Money Exploit.exe
Token: SeUndockPrivilege	2664	Steam Money Exploit.exe
Token: SeManageVolumePrivilege	2664	Steam Money Exploit.exe
Token: SeImpersonatePrivilege	2664	Steam Money Exploit.exe
Token: SeCreateGlobalPrivilege	2664	Steam Money Exploit.exe
Token: 33	2664	Steam Money Exploit.exe
Token: 34	2664	Steam Money Exploit.exe
Token: 35	2664	Steam Money Exploit.exe
Token: SeIncreaseQuotaPrivilege	3064	msdcsc.exe
Token: SeSecurityPrivilege	3064	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3064	msdcsc.exe
Token: SeLoadDriverPrivilege	3064	msdcsc.exe
Token: SeSystemProfilePrivilege	3064	msdcsc.exe
Token: SeSystemtimePrivilege	3064	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3064	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3064	msdcsc.exe
Token: SeCreatePagefilePrivilege	3064	msdcsc.exe
Token: SeBackupPrivilege	3064	msdcsc.exe
Token: SeRestorePrivilege	3064	msdcsc.exe
Token: SeShutdownPrivilege	3064	msdcsc.exe
Token: SeDebugPrivilege	3064	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3064	msdcsc.exe
Token: SeChangeNotifyPrivilege	3064	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3064	msdcsc.exe
Token: SeUndockPrivilege	3064	msdcsc.exe
Token: SeManageVolumePrivilege	3064	msdcsc.exe
Token: SeImpersonatePrivilege	3064	msdcsc.exe
Token: SeCreateGlobalPrivilege	3064	msdcsc.exe
Token: 33	3064	msdcsc.exe
Token: 34	3064	msdcsc.exe
Token: 35	3064	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3064	msdcsc.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2736 wrote to memory of 2664	2736	Steam Money Exploit.exe	30
PID 2664 wrote to memory of 2560	2664	Steam Money Exploit.exe	31
PID 2664 wrote to memory of 2560	2664	Steam Money Exploit.exe	31
PID 2664 wrote to memory of 2560	2664	Steam Money Exploit.exe	31
PID 2664 wrote to memory of 2560	2664	Steam Money Exploit.exe	31
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 2560 wrote to memory of 3064	2560	msdcsc.exe	32
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33
PID 3064 wrote to memory of 3056	3064	msdcsc.exe	33

C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe
"C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe
  "C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
875KB

MD5
2bb231e6b395b212b61e4d9812a96c68

SHA1
64613e8f67107ac12fbde10d3a3e061d93ed8759

SHA256
ca876f0d6b688d44f6cf155996ad3353b200c9cf6951c301a13b8e85f668885e

SHA512
fb722d7a91e4bb6567febda9e1711a22c19644e9758fef40941b1f0fd3817b7e1888fed0189804f4c324182ac8b716b35b05ff78892f74e504be08ca0a8da6d1

Download Submit
memory/2560-54-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2560-37-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2560-34-0x0000000000A40000-0x0000000000B22000-memory.dmp

Filesize
904KB

Download
memory/2560-35-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

Filesize
4KB

Download
memory/2664-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-23-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-36-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-16-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-15-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-14-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-12-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-10-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-8-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-6-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-4-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-22-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-24-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2664-19-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2664-20-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2736-21-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2736-3-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2736-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

Filesize
4KB

Download
memory/2736-2-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2736-1-0x00000000011B0000-0x0000000001292000-memory.dmp

Filesize
904KB

Download
memory/3056-56-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/3064-53-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3064-52-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3064-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3064-55-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3064-97-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads