General
-
Target
84b059d0b1c74fbbcb4bea1cc2da4adcbfc67de84ea9a8c37ee8da96100c5c43
-
Size
252KB
-
Sample
201115-pgq4fn8kae
-
MD5
256af85b0eddc2327bab24817097194a
-
SHA1
215e426721e69b35e3535f1dc8a868ab06f12389
-
SHA256
84b059d0b1c74fbbcb4bea1cc2da4adcbfc67de84ea9a8c37ee8da96100c5c43
-
SHA512
54d006945b25fe51921c449a8d164c7c1c8c5ce48b51e42c6a32d26f26f412b7306856c8a44e73772f659c85dc989bc57f250f5aed9e0747fbe627d682db2a9c
Static task
static1
Behavioral task
behavioral1
Sample
84b059d0b1c74fbbcb4bea1cc2da4adcbfc67de84ea9a8c37ee8da96100c5c43.exe
Resource
win7v20201028
Malware Config
Extracted
darkcomet
lox
logan.bounceme.net:1604
DC_MUTEX-HKYPFJY
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
UoVSUsqvZCVe
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
vshost
Targets
-
-
Target
84b059d0b1c74fbbcb4bea1cc2da4adcbfc67de84ea9a8c37ee8da96100c5c43
-
Size
252KB
-
MD5
256af85b0eddc2327bab24817097194a
-
SHA1
215e426721e69b35e3535f1dc8a868ab06f12389
-
SHA256
84b059d0b1c74fbbcb4bea1cc2da4adcbfc67de84ea9a8c37ee8da96100c5c43
-
SHA512
54d006945b25fe51921c449a8d164c7c1c8c5ce48b51e42c6a32d26f26f412b7306856c8a44e73772f659c85dc989bc57f250f5aed9e0747fbe627d682db2a9c
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-