General
-
Target
45dabf6585b647a7af4df6dd5007701b
-
Size
252KB
-
Sample
201117-rr5swxcsk6
-
MD5
5c436179724fd82d1c46c090f29a916a
-
SHA1
fa95bcede5fd820a786958c2d88dec72a6231a60
-
SHA256
578db85e5915bdc1b5b216892c102885a785dba582eb1dc9484d09804b9c2c09
-
SHA512
05b91de9df9acabc0b7862d560afb0a8087ee20eb518c827d65eb093d5bae50d0ba8601c8e5931dcda1911f2b04c843844641a96941e0a70696c849843710674
Static task
static1
Behavioral task
behavioral1
Sample
45dabf6585b647a7af4df6dd5007701b.exe
Resource
win7v20201028
Malware Config
Extracted
darkcomet
is
hlopvp.ddns.net:1604
DC_MUTEX-BZ014LX
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
K9K3tKtdM1Fc
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
ercsObject
Targets
-
-
Target
45dabf6585b647a7af4df6dd5007701b
-
Size
252KB
-
MD5
5c436179724fd82d1c46c090f29a916a
-
SHA1
fa95bcede5fd820a786958c2d88dec72a6231a60
-
SHA256
578db85e5915bdc1b5b216892c102885a785dba582eb1dc9484d09804b9c2c09
-
SHA512
05b91de9df9acabc0b7862d560afb0a8087ee20eb518c827d65eb093d5bae50d0ba8601c8e5931dcda1911f2b04c843844641a96941e0a70696c849843710674
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-