Analysis
-
max time kernel
14s -
max time network
13s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-01-2025 20:41
General
-
Target
apache.exe
-
Size
252KB
-
MD5
8e747a4c115ac090e54dfa899c287129
-
SHA1
a1c523ad0a2fa1b533fb752a25aa48ff1cd4e1e3
-
SHA256
1117f585985ca4ddd03695876522f80951c919cb41db5854f013923f62285c09
-
SHA512
049fae2cccf4e1afc79d9e72e016f27d7714ad8b747c28ec3ad520bc25ff319f12aced97d16dbbe863aaab11514a9e90477656983fd67939c0e6d2ddb93558b3
-
SSDEEP
6144:ZcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQc:ZcWkbgTYWnYnt/IDYhPn
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
bibl1234.ddns.net:1604
Mutex
DC_MUTEX-QKPH38W
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
2PaBrGj3TwxK
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" apache.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1080 attrib.exe 988 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 1156 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 2180 apache.exe 2180 apache.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" apache.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
resource yara_rule behavioral1/memory/2180-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/files/0x0008000000016edb-6.dat upx behavioral1/memory/1156-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2180-55-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1156-56-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apache.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2180 apache.exe Token: SeSecurityPrivilege 2180 apache.exe Token: SeTakeOwnershipPrivilege 2180 apache.exe Token: SeLoadDriverPrivilege 2180 apache.exe Token: SeSystemProfilePrivilege 2180 apache.exe Token: SeSystemtimePrivilege 2180 apache.exe Token: SeProfSingleProcessPrivilege 2180 apache.exe Token: SeIncBasePriorityPrivilege 2180 apache.exe Token: SeCreatePagefilePrivilege 2180 apache.exe Token: SeBackupPrivilege 2180 apache.exe Token: SeRestorePrivilege 2180 apache.exe Token: SeShutdownPrivilege 2180 apache.exe Token: SeDebugPrivilege 2180 apache.exe Token: SeSystemEnvironmentPrivilege 2180 apache.exe Token: SeChangeNotifyPrivilege 2180 apache.exe Token: SeRemoteShutdownPrivilege 2180 apache.exe Token: SeUndockPrivilege 2180 apache.exe Token: SeManageVolumePrivilege 2180 apache.exe Token: SeImpersonatePrivilege 2180 apache.exe Token: SeCreateGlobalPrivilege 2180 apache.exe Token: 33 2180 apache.exe Token: 34 2180 apache.exe Token: 35 2180 apache.exe Token: SeIncreaseQuotaPrivilege 1156 msdcsc.exe Token: SeSecurityPrivilege 1156 msdcsc.exe Token: SeTakeOwnershipPrivilege 1156 msdcsc.exe Token: SeLoadDriverPrivilege 1156 msdcsc.exe Token: SeSystemProfilePrivilege 1156 msdcsc.exe Token: SeSystemtimePrivilege 1156 msdcsc.exe Token: SeProfSingleProcessPrivilege 1156 msdcsc.exe Token: SeIncBasePriorityPrivilege 1156 msdcsc.exe Token: SeCreatePagefilePrivilege 1156 msdcsc.exe Token: SeBackupPrivilege 1156 msdcsc.exe Token: SeRestorePrivilege 1156 msdcsc.exe Token: SeShutdownPrivilege 1156 msdcsc.exe Token: SeDebugPrivilege 1156 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1156 msdcsc.exe Token: SeChangeNotifyPrivilege 1156 msdcsc.exe Token: SeRemoteShutdownPrivilege 1156 msdcsc.exe Token: SeUndockPrivilege 1156 msdcsc.exe Token: SeManageVolumePrivilege 1156 msdcsc.exe Token: SeImpersonatePrivilege 1156 msdcsc.exe Token: SeCreateGlobalPrivilege 1156 msdcsc.exe Token: 33 1156 msdcsc.exe Token: 34 1156 msdcsc.exe Token: 35 1156 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1156 msdcsc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1692 2180 apache.exe 30 PID 2180 wrote to memory of 1692 2180 apache.exe 30 PID 2180 wrote to memory of 1692 2180 apache.exe 30 PID 2180 wrote to memory of 1692 2180 apache.exe 30 PID 2180 wrote to memory of 2344 2180 apache.exe 32 PID 2180 wrote to memory of 2344 2180 apache.exe 32 PID 2180 wrote to memory of 2344 2180 apache.exe 32 PID 2180 wrote to memory of 2344 2180 apache.exe 32 PID 1692 wrote to memory of 1080 1692 cmd.exe 34 PID 1692 wrote to memory of 1080 1692 cmd.exe 34 PID 1692 wrote to memory of 1080 1692 cmd.exe 34 PID 1692 wrote to memory of 1080 1692 cmd.exe 34 PID 2344 wrote to memory of 988 2344 cmd.exe 35 PID 2344 wrote to memory of 988 2344 cmd.exe 35 PID 2344 wrote to memory of 988 2344 cmd.exe 35 PID 2344 wrote to memory of 988 2344 cmd.exe 35 PID 2180 wrote to memory of 1156 2180 apache.exe 36 PID 2180 wrote to memory of 1156 2180 apache.exe 36 PID 2180 wrote to memory of 1156 2180 apache.exe 36 PID 2180 wrote to memory of 1156 2180 apache.exe 36 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 PID 1156 wrote to memory of 2848 1156 msdcsc.exe 37 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 988 attrib.exe 1080 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\apache.exe"C:\Users\Admin\AppData\Local\Temp\apache.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\apache.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\apache.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1080
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:988
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1156 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD58e747a4c115ac090e54dfa899c287129
SHA1a1c523ad0a2fa1b533fb752a25aa48ff1cd4e1e3
SHA2561117f585985ca4ddd03695876522f80951c919cb41db5854f013923f62285c09
SHA512049fae2cccf4e1afc79d9e72e016f27d7714ad8b747c28ec3ad520bc25ff319f12aced97d16dbbe863aaab11514a9e90477656983fd67939c0e6d2ddb93558b3