General
-
Target
7118c3db49b6e9278fb34a7696089f4f44f3b8ae4cb85083af64ea2100c5e716
-
Size
658KB
-
Sample
210906-hhm54sdgcj
-
MD5
f7ce32b7a4e41e6d16aaa8c2766ede4d
-
SHA1
4183604cdb185657e8fbcf4e5df2c694cb94049c
-
SHA256
7118c3db49b6e9278fb34a7696089f4f44f3b8ae4cb85083af64ea2100c5e716
-
SHA512
1fcdf94c074d1958ca19fcc107a722b6524f71f4cdff7acf49013f9e5b1b08dba892c605f3ee23cc53f8e053fa3900a6d774501b6447c2a6d6214ddd40ce6fe1
Behavioral task
behavioral1
Sample
7118c3db49b6e9278fb34a7696089f4f44f3b8ae4cb85083af64ea2100c5e716.exe
Resource
win7-en
Malware Config
Extracted
darkcomet
All
:1604
DC_MUTEX-U0DM7GE
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
KUiN9kpfaemv
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
7118c3db49b6e9278fb34a7696089f4f44f3b8ae4cb85083af64ea2100c5e716
-
Size
658KB
-
MD5
f7ce32b7a4e41e6d16aaa8c2766ede4d
-
SHA1
4183604cdb185657e8fbcf4e5df2c694cb94049c
-
SHA256
7118c3db49b6e9278fb34a7696089f4f44f3b8ae4cb85083af64ea2100c5e716
-
SHA512
1fcdf94c074d1958ca19fcc107a722b6524f71f4cdff7acf49013f9e5b1b08dba892c605f3ee23cc53f8e053fa3900a6d774501b6447c2a6d6214ddd40ce6fe1
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-