General
-
Target
6c6a951636ae4dee7a842c6af1d43236.exe
-
Size
1.2MB
-
Sample
210722-khfc1ds4ex
-
MD5
6c6a951636ae4dee7a842c6af1d43236
-
SHA1
387e2f026ca3ec2a291b09fa76f88fe40ae7007c
-
SHA256
2ebc7cf945c4eba60eb0f25f6b58eb8d7d0558f6b5622530b2b3808987173952
-
SHA512
3324a70e328be9cdbbe60f47da1254208032b73e6b48cbfea9d070b50378a1ed0f6df32b62c3b16712b78ddcaa0b696ee196f8e9448c3b0f025a9f1d36857311
Static task
static1
Behavioral task
behavioral1
Sample
6c6a951636ae4dee7a842c6af1d43236.exe
Resource
win7v20210410
Malware Config
Extracted
darkcomet
ADSAW
secret92.ddns.net:82
DC_MUTEX-TAUBLES
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
4ltiP4nFeytX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
6c6a951636ae4dee7a842c6af1d43236.exe
-
Size
1.2MB
-
MD5
6c6a951636ae4dee7a842c6af1d43236
-
SHA1
387e2f026ca3ec2a291b09fa76f88fe40ae7007c
-
SHA256
2ebc7cf945c4eba60eb0f25f6b58eb8d7d0558f6b5622530b2b3808987173952
-
SHA512
3324a70e328be9cdbbe60f47da1254208032b73e6b48cbfea9d070b50378a1ed0f6df32b62c3b16712b78ddcaa0b696ee196f8e9448c3b0f025a9f1d36857311
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-