Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/02/2025, 10:32
Behavioral task
behavioral1
Sample
45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
120 seconds
Behavioral task
behavioral2
Sample
45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
25 signatures
120 seconds
General
-
Target
45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe
-
Size
756KB
-
MD5
91948be53b10984230d6f3f36dc52ef0
-
SHA1
72c8160abf5ad2f39e0cef2ce2bc9a835243265a
-
SHA256
45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472
-
SHA512
5dd7100435381bcfb0562aa1788ed087f2a78607b8671a243f169e7ef6ac03e99b02e07693f5374d94484e4aecc2e5659f25a63f66c578bbea1d151dce35e1f3
-
SSDEEP
12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hF:GZ1xuVVjfFoynPaVBUR8f+kN10EB3
Malware Config
Extracted
Family
darkcomet
Botnet
Mucix
C2
heybeybidonunneydi.no-ip.org:15963
civcivessek.no-ip.org:15963
Mutex
DC_MUTEX-Y88TJ9D
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Fs9Wry9kctNE
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
rc4.plain
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2996 attrib.exe 2732 attrib.exe -
Deletes itself 1 IoCs
pid Process 1052 notepad.exe -
Executes dropped EXE 1 IoCs
pid Process 2204 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe -
Windows security modification 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2204 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeSecurityPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeTakeOwnershipPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeLoadDriverPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeSystemProfilePrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeSystemtimePrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeProfSingleProcessPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeIncBasePriorityPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeCreatePagefilePrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeBackupPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeRestorePrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeShutdownPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeDebugPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeSystemEnvironmentPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeChangeNotifyPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeRemoteShutdownPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeUndockPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeManageVolumePrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeImpersonatePrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeCreateGlobalPrivilege 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: 33 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: 34 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: 35 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe Token: SeIncreaseQuotaPrivilege 2204 msdcsc.exe Token: SeSecurityPrivilege 2204 msdcsc.exe Token: SeTakeOwnershipPrivilege 2204 msdcsc.exe Token: SeLoadDriverPrivilege 2204 msdcsc.exe Token: SeSystemProfilePrivilege 2204 msdcsc.exe Token: SeSystemtimePrivilege 2204 msdcsc.exe Token: SeProfSingleProcessPrivilege 2204 msdcsc.exe Token: SeIncBasePriorityPrivilege 2204 msdcsc.exe Token: SeCreatePagefilePrivilege 2204 msdcsc.exe Token: SeBackupPrivilege 2204 msdcsc.exe Token: SeRestorePrivilege 2204 msdcsc.exe Token: SeShutdownPrivilege 2204 msdcsc.exe Token: SeDebugPrivilege 2204 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2204 msdcsc.exe Token: SeChangeNotifyPrivilege 2204 msdcsc.exe Token: SeRemoteShutdownPrivilege 2204 msdcsc.exe Token: SeUndockPrivilege 2204 msdcsc.exe Token: SeManageVolumePrivilege 2204 msdcsc.exe Token: SeImpersonatePrivilege 2204 msdcsc.exe Token: SeCreateGlobalPrivilege 2204 msdcsc.exe Token: 33 2204 msdcsc.exe Token: 34 2204 msdcsc.exe Token: 35 2204 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2204 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1924 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 30 PID 1916 wrote to memory of 1924 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 30 PID 1916 wrote to memory of 1924 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 30 PID 1916 wrote to memory of 1924 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 30 PID 1916 wrote to memory of 2528 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 31 PID 1916 wrote to memory of 2528 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 31 PID 1916 wrote to memory of 2528 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 31 PID 1916 wrote to memory of 2528 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 31 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 1916 wrote to memory of 1052 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 32 PID 2528 wrote to memory of 2732 2528 cmd.exe 35 PID 2528 wrote to memory of 2732 2528 cmd.exe 35 PID 2528 wrote to memory of 2732 2528 cmd.exe 35 PID 2528 wrote to memory of 2732 2528 cmd.exe 35 PID 1924 wrote to memory of 2996 1924 cmd.exe 36 PID 1924 wrote to memory of 2996 1924 cmd.exe 36 PID 1924 wrote to memory of 2996 1924 cmd.exe 36 PID 1924 wrote to memory of 2996 1924 cmd.exe 36 PID 1916 wrote to memory of 2204 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 37 PID 1916 wrote to memory of 2204 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 37 PID 1916 wrote to memory of 2204 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 37 PID 1916 wrote to memory of 2204 1916 45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe 37 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 PID 2204 wrote to memory of 2808 2204 msdcsc.exe 38 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2996 attrib.exe 2732 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe"C:\Users\Admin\AppData\Local\Temp\45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\45ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472N.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2732
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD591948be53b10984230d6f3f36dc52ef0
SHA172c8160abf5ad2f39e0cef2ce2bc9a835243265a
SHA25645ce5e02895d4f1400ec0ff0491f082ced4661582f6b94ab57dcf080f6182472
SHA5125dd7100435381bcfb0562aa1788ed087f2a78607b8671a243f169e7ef6ac03e99b02e07693f5374d94484e4aecc2e5659f25a63f66c578bbea1d151dce35e1f3