General
-
Target
8b96f06dd85d4881cce875663d61af6f8927dbf6536fcad9b792b9d20494411e
-
Size
1.1MB
-
Sample
210830-grv5mz7jfs
-
MD5
11014e38497574bb8a16e36ec1fc4913
-
SHA1
56411db78d33fe6ad51644ace688a03c1bd65576
-
SHA256
8b96f06dd85d4881cce875663d61af6f8927dbf6536fcad9b792b9d20494411e
-
SHA512
b0071271e88a1eebab2c61e413a07753818b3ad32d285e76c3cc4b03c3bc483b21ced94e3095f80a9ddb0d19f76dce7411636afc8b65dbe2ea722a4491d1adb5
Behavioral task
behavioral1
Sample
8b96f06dd85d4881cce875663d61af6f8927dbf6536fcad9b792b9d20494411e.exe
Resource
win7v20210408
Malware Config
Extracted
darkcomet
Guest16
miluina.ddns.net:1604
DC_MUTEX-E5SBZY0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
5HeumKLx3KTP
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
8b96f06dd85d4881cce875663d61af6f8927dbf6536fcad9b792b9d20494411e
-
Size
1.1MB
-
MD5
11014e38497574bb8a16e36ec1fc4913
-
SHA1
56411db78d33fe6ad51644ace688a03c1bd65576
-
SHA256
8b96f06dd85d4881cce875663d61af6f8927dbf6536fcad9b792b9d20494411e
-
SHA512
b0071271e88a1eebab2c61e413a07753818b3ad32d285e76c3cc4b03c3bc483b21ced94e3095f80a9ddb0d19f76dce7411636afc8b65dbe2ea722a4491d1adb5
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-