General
-
Target
8ee7e2417bc13dfaadd514daa45ce52d9f1838ce47fd7429105117f5b06930f1
-
Size
658KB
-
Sample
210504-lek34f3f5j
-
MD5
ed648fd6199693419b348bde3477c6b8
-
SHA1
289b13ef04fe88efb0cc9131c183d924dcfe1c75
-
SHA256
8ee7e2417bc13dfaadd514daa45ce52d9f1838ce47fd7429105117f5b06930f1
-
SHA512
461be60ece2bc57899fd6c9f4f57dcf3d51488f43782a3637fa0deca6140610a5d8b4d133c8253d23824fc7bd1941e605d3c20b266394e1763a6d35785e98fea
Behavioral task
behavioral1
Sample
8ee7e2417bc13dfaadd514daa45ce52d9f1838ce47fd7429105117f5b06930f1.exe
Resource
win7v20210410
Malware Config
Extracted
darkcomet
all
127.0.0.1:1604
DC_MUTEX-TXHMS77
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
8Z63PmylbyiK
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
8ee7e2417bc13dfaadd514daa45ce52d9f1838ce47fd7429105117f5b06930f1
-
Size
658KB
-
MD5
ed648fd6199693419b348bde3477c6b8
-
SHA1
289b13ef04fe88efb0cc9131c183d924dcfe1c75
-
SHA256
8ee7e2417bc13dfaadd514daa45ce52d9f1838ce47fd7429105117f5b06930f1
-
SHA512
461be60ece2bc57899fd6c9f4f57dcf3d51488f43782a3637fa0deca6140610a5d8b4d133c8253d23824fc7bd1941e605d3c20b266394e1763a6d35785e98fea
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-