General
-
Target
4c44224a2703b19147751b2926bd047e82dd80305141a253418594c6f4672818
-
Size
690KB
-
Sample
220525-aplxmaggej
-
MD5
6b5b75a9e7c39b3737029ac0bde1c152
-
SHA1
def2b6e36621133659ac94cc9bc60cbe7743c6ce
-
SHA256
4c44224a2703b19147751b2926bd047e82dd80305141a253418594c6f4672818
-
SHA512
d0f74e89c78a3baf9907799790b0aba7a7ed8594db502397e52106f0a114aad5c4435a49a59f56a785427b06a59f28636d3de3e6125a82a34b3f07fedc6a4d90
Behavioral task
behavioral1
Sample
4c44224a2703b19147751b2926bd047e82dd80305141a253418594c6f4672818.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
All
127.0.0.1:1604
DC_MUTEX-W1Y6BV1
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6zPJwU2MxqV4
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
4c44224a2703b19147751b2926bd047e82dd80305141a253418594c6f4672818
-
Size
690KB
-
MD5
6b5b75a9e7c39b3737029ac0bde1c152
-
SHA1
def2b6e36621133659ac94cc9bc60cbe7743c6ce
-
SHA256
4c44224a2703b19147751b2926bd047e82dd80305141a253418594c6f4672818
-
SHA512
d0f74e89c78a3baf9907799790b0aba7a7ed8594db502397e52106f0a114aad5c4435a49a59f56a785427b06a59f28636d3de3e6125a82a34b3f07fedc6a4d90
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-