General
-
Target
bcd956aebc76db25ef4891d1b85eaf7151dee287c61637d59aa7c071e258f742
-
Size
251KB
-
Sample
201105-hezy4h6tz2
-
MD5
42c4dc5105eff86f69d8c3d0d1e9e773
-
SHA1
a4c1c4f627ac87cb180f3e70751bf525ef658def
-
SHA256
bcd956aebc76db25ef4891d1b85eaf7151dee287c61637d59aa7c071e258f742
-
SHA512
8017b10da3f275a719dee0d7cdea1fc066af93a99748501d4d2519827f651d1dd7dbab5bab8f8ed268ef5cb72573c6f95a0e77e4e5e0af68a08a524feab8d91f
Static task
static1
Behavioral task
behavioral1
Sample
bcd956aebc76db25ef4891d1b85eaf7151dee287c61637d59aa7c071e258f742.exe
Resource
win7v20201028
Malware Config
Extracted
darkcomet
User
tarkovbanned.hopto.org:1337
DC_MUTEX-BBUXYWX
-
InstallPath
nVidiaExpe\nvmdch.exe
-
gencode
bZniVw7x2f7P
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
bcd956aebc76db25ef4891d1b85eaf7151dee287c61637d59aa7c071e258f742
-
Size
251KB
-
MD5
42c4dc5105eff86f69d8c3d0d1e9e773
-
SHA1
a4c1c4f627ac87cb180f3e70751bf525ef658def
-
SHA256
bcd956aebc76db25ef4891d1b85eaf7151dee287c61637d59aa7c071e258f742
-
SHA512
8017b10da3f275a719dee0d7cdea1fc066af93a99748501d4d2519827f651d1dd7dbab5bab8f8ed268ef5cb72573c6f95a0e77e4e5e0af68a08a524feab8d91f
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-