darkcomet | 1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a6cf62409d259d281c82ae00259d66.exe
Size

700KB
MD5

17a6cf62409d259d281c82ae00259d66
SHA1

15c2bccc3f8bc41190eaa6b49da6c99eccf1602d
SHA256

1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64
SHA512

2d0e56b9117b7dd0f6f1910dad82b09f9e1d693d238422498c93c3d14e6de7ebdef4bd0decfc20582305b1ed41db98ff4bd447da72181dc97e6aa8601fd6110b
SSDEEP

12288:/yPPQ1ufEoYFwm4jFySBXY3sHuss0dtyxvlrKnnmRjVLPrJHbFJ8:/yPPMpoY6HXY3Kusfexv4n6jVLxc

Score

10^/10

darkcomet åååååååååå persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

åååååååååå

ogdd.servemp3.com:4433

Mutex

DC_MUTEX-LGYC4QH

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
7UYk2EHbmDiQ
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

17a6cf62409d259d281c82ae00259d66.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	17a6cf62409d259d281c82ae00259d66.exe

Drops file in Drivers directory 1 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts 17a6cf62409d259d281c82ae00259d66.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

17a6cf62409d259d281c82ae00259d66.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 17a6cf62409d259d281c82ae00259d66.exe
Executes dropped EXE 2 IoCs

Processes:

msdcsc.exemsdcsc.exe

pid process

3076 msdcsc.exe
4368 msdcsc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	17a6cf62409d259d281c82ae00259d66.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	17a6cf62409d259d281c82ae00259d66.exe

pid	process
3076	msdcsc.exe
4368	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	17a6cf62409d259d281c82ae00259d66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	pid	process	target process
PID 4372 set thread context of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 3076 set thread context of 4368	3076	msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSecurityPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeTakeOwnershipPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeLoadDriverPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSystemProfilePrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSystemtimePrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeProfSingleProcessPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeIncBasePriorityPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeCreatePagefilePrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeBackupPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeRestorePrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeShutdownPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeDebugPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeSystemEnvironmentPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeChangeNotifyPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeRemoteShutdownPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeUndockPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeManageVolumePrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeImpersonatePrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeCreateGlobalPrivilege	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: 33	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: 34	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: 35	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: 36	1060	17a6cf62409d259d281c82ae00259d66.exe
Token: SeIncreaseQuotaPrivilege	4368	msdcsc.exe
Token: SeSecurityPrivilege	4368	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4368	msdcsc.exe
Token: SeLoadDriverPrivilege	4368	msdcsc.exe
Token: SeSystemProfilePrivilege	4368	msdcsc.exe
Token: SeSystemtimePrivilege	4368	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4368	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4368	msdcsc.exe
Token: SeCreatePagefilePrivilege	4368	msdcsc.exe
Token: SeBackupPrivilege	4368	msdcsc.exe
Token: SeRestorePrivilege	4368	msdcsc.exe
Token: SeShutdownPrivilege	4368	msdcsc.exe
Token: SeDebugPrivilege	4368	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4368	msdcsc.exe
Token: SeChangeNotifyPrivilege	4368	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4368	msdcsc.exe
Token: SeUndockPrivilege	4368	msdcsc.exe
Token: SeManageVolumePrivilege	4368	msdcsc.exe
Token: SeImpersonatePrivilege	4368	msdcsc.exe
Token: SeCreateGlobalPrivilege	4368	msdcsc.exe
Token: 33	4368	msdcsc.exe
Token: 34	4368	msdcsc.exe
Token: 35	4368	msdcsc.exe
Token: 36	4368	msdcsc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exemsdcsc.exemsdcsc.exe

pid process

4372 17a6cf62409d259d281c82ae00259d66.exe
3076 msdcsc.exe
4368 msdcsc.exe

pid	process
4372	17a6cf62409d259d281c82ae00259d66.exe
3076	msdcsc.exe
4368	msdcsc.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

17a6cf62409d259d281c82ae00259d66.exe17a6cf62409d259d281c82ae00259d66.exemsdcsc.exe

description	pid	process	target process
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 4372 wrote to memory of 1060	4372	17a6cf62409d259d281c82ae00259d66.exe	17a6cf62409d259d281c82ae00259d66.exe
PID 1060 wrote to memory of 3076	1060	17a6cf62409d259d281c82ae00259d66.exe	msdcsc.exe
PID 1060 wrote to memory of 3076	1060	17a6cf62409d259d281c82ae00259d66.exe	msdcsc.exe
PID 1060 wrote to memory of 3076	1060	17a6cf62409d259d281c82ae00259d66.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe
PID 3076 wrote to memory of 4368	3076	msdcsc.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe
"C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372

C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe
"C:\Users\Admin\AppData\Local\Temp\17a6cf62409d259d281c82ae00259d66.exe"
2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3964,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:5052

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
700KB

MD5
17a6cf62409d259d281c82ae00259d66

SHA1
15c2bccc3f8bc41190eaa6b49da6c99eccf1602d

SHA256
1ccaafea3b64fe2c5e7859d550ade584d93e7bdc28472317022693456c6f2c64

SHA512
2d0e56b9117b7dd0f6f1910dad82b09f9e1d693d238422498c93c3d14e6de7ebdef4bd0decfc20582305b1ed41db98ff4bd447da72181dc97e6aa8601fd6110b

Download Submit
memory/1060-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1060-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1060-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1060-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1060-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1060-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3076-44-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/3076-51-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download
memory/3076-47-0x00000000021C0000-0x00000000021D0000-memory.dmp

Filesize
64KB

Download
memory/3076-40-0x0000000000590000-0x00000000005A0000-memory.dmp

Filesize
64KB

Download
memory/3076-43-0x00000000005C0000-0x00000000005D0000-memory.dmp

Filesize
64KB

Download
memory/3076-56-0x0000000002250000-0x0000000002260000-memory.dmp

Filesize
64KB

Download
memory/3076-45-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/3076-49-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download
memory/3076-50-0x00000000021F0000-0x0000000002200000-memory.dmp

Filesize
64KB

Download
memory/3076-39-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/3076-52-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/3076-53-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/3076-54-0x0000000002230000-0x0000000002240000-memory.dmp

Filesize
64KB

Download
memory/3076-55-0x0000000002240000-0x0000000002250000-memory.dmp

Filesize
64KB

Download
memory/3076-46-0x00000000021A0000-0x00000000021B0000-memory.dmp

Filesize
64KB

Download
memory/3076-42-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download
memory/3076-41-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/3076-48-0x00000000021D0000-0x00000000021E0000-memory.dmp

Filesize
64KB

Download
memory/4368-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-85-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-84-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4368-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4372-12-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/4372-0-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/4372-9-0x00000000020C0000-0x00000000020D0000-memory.dmp

Filesize
64KB

Download
memory/4372-8-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/4372-15-0x0000000002120000-0x0000000002130000-memory.dmp

Filesize
64KB

Download
memory/4372-14-0x0000000002110000-0x0000000002120000-memory.dmp

Filesize
64KB

Download
memory/4372-11-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/4372-13-0x0000000002100000-0x0000000002110000-memory.dmp

Filesize
64KB

Download
memory/4372-1-0x0000000000590000-0x00000000005A0000-memory.dmp

Filesize
64KB

Download
memory/4372-10-0x00000000020D0000-0x00000000020E0000-memory.dmp

Filesize
64KB

Download
memory/4372-16-0x0000000002130000-0x0000000002140000-memory.dmp

Filesize
64KB

Download
memory/4372-7-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/4372-6-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/4372-5-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/4372-4-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/4372-3-0x00000000005C0000-0x00000000005D0000-memory.dmp

Filesize
64KB

Download
memory/4372-2-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/4372-17-0x0000000002150000-0x0000000002160000-memory.dmp

Filesize
64KB

Download