General
-
Target
d8aeefe49869abecc7719bedc0eed1e0630a1c4d9208db72a06be52c9e6343f2
-
Size
658KB
-
Sample
220520-2kp72afec2
-
MD5
4d693fde464e00a60c0c87d8a8c4e27c
-
SHA1
9efd17718385a0445d40ce1c3de86b9bd18a33a0
-
SHA256
d8aeefe49869abecc7719bedc0eed1e0630a1c4d9208db72a06be52c9e6343f2
-
SHA512
05e358afa6d9419a501125cc57fe8976cddf1b358a7a30d8158d08b439379e00d068e8c8dcde6e65de98a19bedb3ae6521ce412835c7a64348438f05042eaab4
Behavioral task
behavioral1
Sample
d8aeefe49869abecc7719bedc0eed1e0630a1c4d9208db72a06be52c9e6343f2.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
Guest16
sasha8787.hopto.org:1604
DC_MUTEX-0E94YVE
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
jc8H9yZoi6Sf
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
d8aeefe49869abecc7719bedc0eed1e0630a1c4d9208db72a06be52c9e6343f2
-
Size
658KB
-
MD5
4d693fde464e00a60c0c87d8a8c4e27c
-
SHA1
9efd17718385a0445d40ce1c3de86b9bd18a33a0
-
SHA256
d8aeefe49869abecc7719bedc0eed1e0630a1c4d9208db72a06be52c9e6343f2
-
SHA512
05e358afa6d9419a501125cc57fe8976cddf1b358a7a30d8158d08b439379e00d068e8c8dcde6e65de98a19bedb3ae6521ce412835c7a64348438f05042eaab4
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-