darkcomet | 1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a6cf62409d259d281c82ae00259d66.exe
Size

700KB
MD5

17a6cf62409d259d281c82ae00259d66
SHA1

15c2bccc3f8bc41190eaa6b49da6c99eccf1602d
SHA256

1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64
SHA512

2d0e56b9117b7dd0f6f1910dad82b09f9e1d693d238422498c93c3d14e6de7ebdef4bd0decfc20582305b1ed41db98ff4bd447da72181dc97e6aa8601fd6110b
SSDEEP

12288:/yPPQ1ufEoYFwm4jFySBXY3sHuss0dtyxvlrKnnmRjVLPrJHbFJ8:/yPPMpoY6HXY3Kusfexv4n6jVLxc

Score

10^/10

darkcomet åååååååååå persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

åååååååååå

ogdd.servemp3.com:4433

Mutex

DC_MUTEX-LGYC4QH

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
7UYk2EHbmDiQ
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

17a6cf62409d259d281c82ae00259d66.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	17a6cf62409d259d281c82ae00259d66.exe

Drops file in Drivers directory 1 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts 17a6cf62409d259d281c82ae00259d66.exe
Executes dropped EXE 2 IoCs

Processes:

msdcsc.exemsdcsc.exe

pid process

3000 msdcsc.exe
2724 msdcsc.exe
Loads dropped DLL 3 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

pid process

2396 17a6cf62409d259d281c82ae00259d66.exe
2396 17a6cf62409d259d281c82ae00259d66.exe
3000 msdcsc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	17a6cf62409d259d281c82ae00259d66.exe

pid	process
3000	msdcsc.exe
2724	msdcsc.exe

pid	process
2396	17a6cf62409d259d281c82ae00259d66.exe
2396	17a6cf62409d259d281c82ae00259d66.exe
3000	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	17a6cf62409d259d281c82ae00259d66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	pid	process	target process
PID 2844 set thread context of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 3000 set thread context of 2724	3000	msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSecurityPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeTakeOwnershipPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeLoadDriverPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSystemProfilePrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSystemtimePrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeProfSingleProcessPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeIncBasePriorityPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeCreatePagefilePrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeBackupPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeRestorePrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeShutdownPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeDebugPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSystemEnvironmentPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeChangeNotifyPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeRemoteShutdownPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeUndockPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeManageVolumePrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeImpersonatePrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeCreateGlobalPrivilege	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: 33	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: 34	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: 35	2396	17a6cf62409d259d281c82ae00259d66.exe
Token: SeIncreaseQuotaPrivilege	2724	msdcsc.exe
Token: SeSecurityPrivilege	2724	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2724	msdcsc.exe
Token: SeLoadDriverPrivilege	2724	msdcsc.exe
Token: SeSystemProfilePrivilege	2724	msdcsc.exe
Token: SeSystemtimePrivilege	2724	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2724	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2724	msdcsc.exe
Token: SeCreatePagefilePrivilege	2724	msdcsc.exe
Token: SeBackupPrivilege	2724	msdcsc.exe
Token: SeRestorePrivilege	2724	msdcsc.exe
Token: SeShutdownPrivilege	2724	msdcsc.exe
Token: SeDebugPrivilege	2724	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2724	msdcsc.exe
Token: SeChangeNotifyPrivilege	2724	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2724	msdcsc.exe
Token: SeUndockPrivilege	2724	msdcsc.exe
Token: SeManageVolumePrivilege	2724	msdcsc.exe
Token: SeImpersonatePrivilege	2724	msdcsc.exe
Token: SeCreateGlobalPrivilege	2724	msdcsc.exe
Token: 33	2724	msdcsc.exe
Token: 34	2724	msdcsc.exe
Token: 35	2724	msdcsc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exemsdcsc.exe

pid process

2844 17a6cf62409d259d281c82ae00259d66.exe
3000 msdcsc.exe
2724 msdcsc.exe

pid	process
2844	17a6cf62409d259d281c82ae00259d66.exe
3000	msdcsc.exe
2724	msdcsc.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exe17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	pid	process	target process
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2844 wrote to memory of 2396	2844	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 2396 wrote to memory of 3000	2396	17a6cf62409d259d281c82ae00259d66.exe	msdcsc.exe
PID 2396 wrote to memory of 3000	2396	17a6cf62409d259d281c82ae00259d66.exe	msdcsc.exe
PID 2396 wrote to memory of 3000	2396	17a6cf62409d259d281c82ae00259d66.exe	msdcsc.exe
PID 2396 wrote to memory of 3000	2396	17a6cf62409d259d281c82ae00259d66.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe
PID 3000 wrote to memory of 2724	3000	msdcsc.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe
"C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe
"C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe"
2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2724

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
700KB

MD5
17a6cf62409d259d281c82ae00259d66

SHA1
15c2bccc3f8bc41190eaa6b49da6c99eccf1602d

SHA256
1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64

SHA512
2d0e56b9117b7dd0f6f1910dad82b09f9e1d693d238422498c93c3d14e6de7ebdef4bd0decfc20582305b1ed41db98ff4bd447da72181dc97e6aa8601fd6110b

Download Submit
memory/2396-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2396-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2396-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2396-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2396-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2396-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-84-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2724-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2844-16-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2844-1-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2844-10-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/2844-9-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2844-8-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2844-7-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2844-6-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/2844-5-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/2844-4-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2844-3-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2844-2-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2844-0-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2844-15-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2844-17-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/2844-11-0x0000000000320000-0x0000000000330000-memory.dmp

Filesize
64KB

Download
memory/2844-12-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/2844-14-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2844-13-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/3000-48-0x0000000000480000-0x0000000000490000-memory.dmp

Filesize
64KB

Download
memory/3000-47-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/3000-45-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/3000-44-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/3000-43-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/3000-41-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/3000-46-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/3000-50-0x00000000004A0000-0x00000000004B0000-memory.dmp

Filesize
64KB

Download
memory/3000-53-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/3000-52-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/3000-51-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/3000-54-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/3000-42-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/3000-49-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download