Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/02/2025, 13:22
Behavioral task
behavioral1
Sample
7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe
Resource
win7-20240729-en
windows7-x64
22 signatures
120 seconds
Behavioral task
behavioral2
Sample
7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe
Resource
win10v2004-20250211-en
windows10-2004-x64
25 signatures
120 seconds
General
-
Target
7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe
-
Size
756KB
-
MD5
29e0da04e8aa29efc9a91358cffbafc7
-
SHA1
16590f4e92c1cfef08237f08b48cdccb2c7e4cfc
-
SHA256
7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035
-
SHA512
77b9bd299093671ed967c01fc5dbe3e89b484c4c75fdb3294b96f8e5aca17be5145010e04fd5112bf056e6c273bba13f07c1269898b66cf520bea34dfcecc870
-
SSDEEP
12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ht:GZ1xuVVjfFoynPaVBUR8f+kN10EBv
Malware Config
Extracted
Family
darkcomet
Botnet
Mucix
C2
heybeybidonunneydi.no-ip.org:15963
civcivessek.no-ip.org:15963
Mutex
DC_MUTEX-Y88TJ9D
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Fs9Wry9kctNE
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
rc4.plain
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2192 attrib.exe 2876 attrib.exe -
Deletes itself 1 IoCs
pid Process 2260 notepad.exe -
Executes dropped EXE 1 IoCs
pid Process 3036 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe -
Windows security modification 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3036 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeSecurityPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeTakeOwnershipPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeLoadDriverPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeSystemProfilePrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeSystemtimePrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeProfSingleProcessPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeIncBasePriorityPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeCreatePagefilePrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeBackupPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeRestorePrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeShutdownPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeDebugPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeSystemEnvironmentPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeChangeNotifyPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeRemoteShutdownPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeUndockPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeManageVolumePrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeImpersonatePrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeCreateGlobalPrivilege 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: 33 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: 34 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: 35 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe Token: SeIncreaseQuotaPrivilege 3036 msdcsc.exe Token: SeSecurityPrivilege 3036 msdcsc.exe Token: SeTakeOwnershipPrivilege 3036 msdcsc.exe Token: SeLoadDriverPrivilege 3036 msdcsc.exe Token: SeSystemProfilePrivilege 3036 msdcsc.exe Token: SeSystemtimePrivilege 3036 msdcsc.exe Token: SeProfSingleProcessPrivilege 3036 msdcsc.exe Token: SeIncBasePriorityPrivilege 3036 msdcsc.exe Token: SeCreatePagefilePrivilege 3036 msdcsc.exe Token: SeBackupPrivilege 3036 msdcsc.exe Token: SeRestorePrivilege 3036 msdcsc.exe Token: SeShutdownPrivilege 3036 msdcsc.exe Token: SeDebugPrivilege 3036 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3036 msdcsc.exe Token: SeChangeNotifyPrivilege 3036 msdcsc.exe Token: SeRemoteShutdownPrivilege 3036 msdcsc.exe Token: SeUndockPrivilege 3036 msdcsc.exe Token: SeManageVolumePrivilege 3036 msdcsc.exe Token: SeImpersonatePrivilege 3036 msdcsc.exe Token: SeCreateGlobalPrivilege 3036 msdcsc.exe Token: 33 3036 msdcsc.exe Token: 34 3036 msdcsc.exe Token: 35 3036 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3036 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2924 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 28 PID 2340 wrote to memory of 2924 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 28 PID 2340 wrote to memory of 2924 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 28 PID 2340 wrote to memory of 2924 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 28 PID 2340 wrote to memory of 2588 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 29 PID 2340 wrote to memory of 2588 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 29 PID 2340 wrote to memory of 2588 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 29 PID 2340 wrote to memory of 2588 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 29 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2340 wrote to memory of 2260 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 30 PID 2924 wrote to memory of 2192 2924 cmd.exe 33 PID 2924 wrote to memory of 2192 2924 cmd.exe 33 PID 2924 wrote to memory of 2192 2924 cmd.exe 33 PID 2924 wrote to memory of 2192 2924 cmd.exe 33 PID 2588 wrote to memory of 2876 2588 cmd.exe 34 PID 2588 wrote to memory of 2876 2588 cmd.exe 34 PID 2588 wrote to memory of 2876 2588 cmd.exe 34 PID 2588 wrote to memory of 2876 2588 cmd.exe 34 PID 2340 wrote to memory of 3036 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 35 PID 2340 wrote to memory of 3036 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 35 PID 2340 wrote to memory of 3036 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 35 PID 2340 wrote to memory of 3036 2340 7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe 35 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 PID 3036 wrote to memory of 2308 3036 msdcsc.exe 36 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2192 attrib.exe 2876 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe"C:\Users\Admin\AppData\Local\Temp\7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\7639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2192
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2876
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2260
-
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2308
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD529e0da04e8aa29efc9a91358cffbafc7
SHA116590f4e92c1cfef08237f08b48cdccb2c7e4cfc
SHA2567639776db988583b407620c0fbdeb6b320876e9eca997ccb0f2bc2a379b0f035
SHA51277b9bd299093671ed967c01fc5dbe3e89b484c4c75fdb3294b96f8e5aca17be5145010e04fd5112bf056e6c273bba13f07c1269898b66cf520bea34dfcecc870