Overview

overview

10

Static

static

3

2025-04-17...er.exe

windows10-2004-x64

10

2025-04-17...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2025, 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe

  • Size

    527KB

  • MD5

    2936e22ea8907d6f85a25b2feb62650f

  • SHA1

    3e367491a43877ccf90ec1b2a46af3153fedf8a7

  • SHA256

    e378da59a68622d81932cacab8d8193de42ee4628756dc116c74d70efb6bbb69

  • SHA512

    dee95cfc6f7e9c2060bd9f83a9466fe0f7ff543c8b9b790fee398c0133be2bf87c73a6dfdae9cca7839f1633ac104e469d3811d248f2c952ae6470a970729060

  • SSDEEP

    12288:ewK1jIDqUT8uCGUCs4eNS+mrp+3OhAICBGtnA:eGDNPCms4eNiQpjG

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:82

mjahanzaib.no-ip.org:82
Mutex

DC_MUTEX-3H9BAQL

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    ptMnX4vVfS9k

  • install

    true

  • offline_keylogger

    true

  • password

    0123456789

  • persistence

    true

  • reg_key

    Sms sender

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Windows security bypass 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Disables Task Manager via registry modification
    defense_evasion
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Windows\SysWOW64\cmd.exe
      /c net stop MpsSvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\SysWOW64\net.exe
        net stop MpsSvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MpsSvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4756
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3600 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4404
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3600 CREDAT:17416 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3532
    • C:\Users\Admin\AppData\Local\Temp\2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe" +s +h
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4080
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe" +s +h
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2156
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:32
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5088
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:4632
      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
        "C:\Windows\system32\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4648
        • C:\Windows\SysWOW64\cmd.exe
          /c net stop MpsSvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3828
          • C:\Windows\SysWOW64\net.exe
            net stop MpsSvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4820
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop MpsSvc
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3212
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          PID:920
        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
          C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
          4⤵
          • Modifies firewall policy service
          • Modifies security service
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4996
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3972
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
    1⤵
      PID:4544
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
      1⤵
        PID:232
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
        1⤵
          PID:4424
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
          1⤵
            PID:4004
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
            1⤵
              PID:3932
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
              1⤵
                PID:4792
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                1⤵
                  PID:1056
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                  1⤵
                    PID:3308
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                    1⤵
                      PID:3904
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                      1⤵
                        PID:4836
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                        1⤵
                          PID:3428
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                          1⤵
                            PID:4548
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                            1⤵
                              PID:2164
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                              1⤵
                                PID:3952
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
                                1⤵
                                  PID:4504

                                Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Persistence

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Winlogon Helper DLL

                                1
                                T1547.004

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Winlogon Helper DLL

                                1
                                T1547.004

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Defense Evasion

                                Hide Artifacts

                                2
                                T1564

                                Hidden Files and Directories

                                2
                                T1564.001

                                Impair Defenses

                                3
                                T1562

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Disable or Modify Tools

                                2
                                T1562.001

                                Modify Registry

                                8
                                T1112

                                Credential Access

                                Discovery

                                Query Registry

                                1
                                T1012

                                System Information Discovery

                                2
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Collection

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
                                  Filesize

                                  471B

                                  MD5

                                  0632c98a0b7882e2629d1bacc0066122

                                  SHA1

                                  51475e3243536402ebf857debc0ef0d784fc23f7

                                  SHA256

                                  f6cdd0d6cd1b9e9c32b75493f8d151a8f3af0074c5815185a27bb9e5d20a27f5

                                  SHA512

                                  b86f2740de8139222e1686df06dbce04c641df3cad1a6c2b167908b767f3ba0f7696db6d77c18d6dc8071b81bdb5d04cb560998f97c66b58adfa8bbbe6305638

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
                                  Filesize

                                  412B

                                  MD5

                                  b1427f03c14c861a2488e15fbbb07966

                                  SHA1

                                  dc3ae8abe785dc6d0de68e0157d60e893304d846

                                  SHA256

                                  278c81d90b48b8d8b2f79012316e372c787e29dd5450ebf25487d2b7dc80c6d7

                                  SHA512

                                  9098d41e7afab0b95bce38ed35560ee0eb03f847050eb85f9120f399206815fc51401bcab223f25aad78e667b66e2636da15d8983bf5d78a7ef0914ed1db708f

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\98N7BPKJ\suggestions[1].en-US
                                  Filesize

                                  17KB

                                  MD5

                                  5a34cb996293fde2cb7a4ac89587393a

                                  SHA1

                                  3c96c993500690d1a77873cd62bc639b3a10653f

                                  SHA256

                                  c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                  SHA512

                                  e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\2025-04-17_2936e22ea8907d6f85a25b2feb62650f_amadey_elex_rhadamanthys_smoke-loader.exe
                                  Filesize

                                  527KB

                                  MD5

                                  2936e22ea8907d6f85a25b2feb62650f

                                  SHA1

                                  3e367491a43877ccf90ec1b2a46af3153fedf8a7

                                  SHA256

                                  e378da59a68622d81932cacab8d8193de42ee4628756dc116c74d70efb6bbb69

                                  SHA512

                                  dee95cfc6f7e9c2060bd9f83a9466fe0f7ff543c8b9b790fee398c0133be2bf87c73a6dfdae9cca7839f1633ac104e469d3811d248f2c952ae6470a970729060

                                  Download Submit

                                • memory/3600-1-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/3972-82-0x0000000001300000-0x0000000001301000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4228-7-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4228-11-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4228-72-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4228-8-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4228-6-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4228-5-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4632-13-0x0000000000410000-0x0000000000411000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4940-0-0x0000000000560000-0x0000000000566000-memory.dmp

                                  Filesize

                                  24KB

                                  Download

                                • memory/4996-84-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-107-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-86-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-83-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-81-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-92-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-93-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-94-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-80-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-85-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-108-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-109-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-110-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-111-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-112-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-113-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download

                                • memory/4996-114-0x0000000000400000-0x00000000004E8000-memory.dmp

                                  Filesize

                                  928KB

                                  Download