General
-
Target
421cc26f9fa03acda748215dd8f5d3cbb22eff317fbcfacfbb2e6e6156309429
-
Size
283KB
-
Sample
220520-1jm6lshbcr
-
MD5
a9d55d08eecc9a13a7526c6757376596
-
SHA1
d7b781ba204e4f2dbb67dbbb743fb843a7c72bab
-
SHA256
421cc26f9fa03acda748215dd8f5d3cbb22eff317fbcfacfbb2e6e6156309429
-
SHA512
0045848210d02543d3d4516c9e20915890b74415decd53892f8d7a409de54073c1c335e3249860f9ff901adec57b0a5cb787f45a170dab295349f43daa6bf684
Behavioral task
behavioral1
Sample
421cc26f9fa03acda748215dd8f5d3cbb22eff317fbcfacfbb2e6e6156309429.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
All
levkrasov.ddns.net:1604
DC_MUTEX-PNB7RY0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
JXB7ZZYb5lzu
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
421cc26f9fa03acda748215dd8f5d3cbb22eff317fbcfacfbb2e6e6156309429
-
Size
283KB
-
MD5
a9d55d08eecc9a13a7526c6757376596
-
SHA1
d7b781ba204e4f2dbb67dbbb743fb843a7c72bab
-
SHA256
421cc26f9fa03acda748215dd8f5d3cbb22eff317fbcfacfbb2e6e6156309429
-
SHA512
0045848210d02543d3d4516c9e20915890b74415decd53892f8d7a409de54073c1c335e3249860f9ff901adec57b0a5cb787f45a170dab295349f43daa6bf684
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-