darkcomet | 099298eb0d27113f15636f07de5e7ab7995d432b928ef22a54e2c204117c4be4

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam Money Exploit.exe
Size

875KB
MD5

2bb231e6b395b212b61e4d9812a96c68
SHA1

64613e8f67107ac12fbde10d3a3e061d93ed8759
SHA256

ca876f0d6b688d44f6cf155996ad3353b200c9cf6951c301a13b8e85f668885e
SHA512

fb722d7a91e4bb6567febda9e1711a22c19644e9758fef40941b1f0fd3817b7e1888fed0189804f4c324182ac8b716b35b05ff78892f74e504be08ca0a8da6d1
SSDEEP

12288:oGWkDv2vfM2Ag6rh4fR0VZmVYDskAk2UNNzwISHpsNo:tWkDeDAgmhYShrHp3

Score

10^/10

darkcomet hacked discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

HackeD

hackos.no-ip.biz:1604

Mutex

DC_MUTEX-W73HHNJ

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
sBdcyo0RLfX2
install
true
offline_keylogger
true
password
koperek
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Steam Money Exploit.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Steam Money Exploit.exe

Executes dropped EXE 2 IoCs

pid	Process
408	msdcsc.exe
2812	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Steam Money Exploit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4100 set thread context of 4040	4100	Steam Money Exploit.exe	84
PID 408 set thread context of 2812	408	msdcsc.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam Money Exploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam Money Exploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4040	Steam Money Exploit.exe
Token: SeSecurityPrivilege	4040	Steam Money Exploit.exe
Token: SeTakeOwnershipPrivilege	4040	Steam Money Exploit.exe
Token: SeLoadDriverPrivilege	4040	Steam Money Exploit.exe
Token: SeSystemProfilePrivilege	4040	Steam Money Exploit.exe
Token: SeSystemtimePrivilege	4040	Steam Money Exploit.exe
Token: SeProfSingleProcessPrivilege	4040	Steam Money Exploit.exe
Token: SeIncBasePriorityPrivilege	4040	Steam Money Exploit.exe
Token: SeCreatePagefilePrivilege	4040	Steam Money Exploit.exe
Token: SeBackupPrivilege	4040	Steam Money Exploit.exe
Token: SeRestorePrivilege	4040	Steam Money Exploit.exe
Token: SeShutdownPrivilege	4040	Steam Money Exploit.exe
Token: SeDebugPrivilege	4040	Steam Money Exploit.exe
Token: SeSystemEnvironmentPrivilege	4040	Steam Money Exploit.exe
Token: SeChangeNotifyPrivilege	4040	Steam Money Exploit.exe
Token: SeRemoteShutdownPrivilege	4040	Steam Money Exploit.exe
Token: SeUndockPrivilege	4040	Steam Money Exploit.exe
Token: SeManageVolumePrivilege	4040	Steam Money Exploit.exe
Token: SeImpersonatePrivilege	4040	Steam Money Exploit.exe
Token: SeCreateGlobalPrivilege	4040	Steam Money Exploit.exe
Token: 33	4040	Steam Money Exploit.exe
Token: 34	4040	Steam Money Exploit.exe
Token: 35	4040	Steam Money Exploit.exe
Token: 36	4040	Steam Money Exploit.exe
Token: SeIncreaseQuotaPrivilege	2812	msdcsc.exe
Token: SeSecurityPrivilege	2812	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2812	msdcsc.exe
Token: SeLoadDriverPrivilege	2812	msdcsc.exe
Token: SeSystemProfilePrivilege	2812	msdcsc.exe
Token: SeSystemtimePrivilege	2812	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2812	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2812	msdcsc.exe
Token: SeCreatePagefilePrivilege	2812	msdcsc.exe
Token: SeBackupPrivilege	2812	msdcsc.exe
Token: SeRestorePrivilege	2812	msdcsc.exe
Token: SeShutdownPrivilege	2812	msdcsc.exe
Token: SeDebugPrivilege	2812	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2812	msdcsc.exe
Token: SeChangeNotifyPrivilege	2812	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2812	msdcsc.exe
Token: SeUndockPrivilege	2812	msdcsc.exe
Token: SeManageVolumePrivilege	2812	msdcsc.exe
Token: SeImpersonatePrivilege	2812	msdcsc.exe
Token: SeCreateGlobalPrivilege	2812	msdcsc.exe
Token: 33	2812	msdcsc.exe
Token: 34	2812	msdcsc.exe
Token: 35	2812	msdcsc.exe
Token: 36	2812	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2812	msdcsc.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4100 wrote to memory of 4040	4100	Steam Money Exploit.exe	84
PID 4040 wrote to memory of 408	4040	Steam Money Exploit.exe	85
PID 4040 wrote to memory of 408	4040	Steam Money Exploit.exe	85
PID 4040 wrote to memory of 408	4040	Steam Money Exploit.exe	85
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 408 wrote to memory of 2812	408	msdcsc.exe	88
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89
PID 2812 wrote to memory of 3620	2812	msdcsc.exe	89

C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe
"C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe
  "C:\Users\Admin\AppData\Local\Temp\Steam Money Exploit.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
875KB

MD5
2bb231e6b395b212b61e4d9812a96c68

SHA1
64613e8f67107ac12fbde10d3a3e061d93ed8759

SHA256
ca876f0d6b688d44f6cf155996ad3353b200c9cf6951c301a13b8e85f668885e

SHA512
fb722d7a91e4bb6567febda9e1711a22c19644e9758fef40941b1f0fd3817b7e1888fed0189804f4c324182ac8b716b35b05ff78892f74e504be08ca0a8da6d1

Download Submit
memory/408-35-0x0000000073870000-0x0000000074020000-memory.dmp

Filesize
7.7MB

Download
memory/408-27-0x0000000073870000-0x0000000074020000-memory.dmp

Filesize
7.7MB

Download
memory/408-25-0x000000007387E000-0x000000007387F000-memory.dmp

Filesize
4KB

Download
memory/2812-39-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2812-38-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2812-37-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2812-34-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2812-33-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2812-32-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3620-36-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/4040-5-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4040-11-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/4040-26-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4040-10-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4040-8-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4040-6-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4100-9-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4100-0-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/4100-4-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/4100-3-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4100-2-0x00000000051A0000-0x0000000005744000-memory.dmp

Filesize
5.6MB

Download
memory/4100-1-0x00000000001E0000-0x00000000002C2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads