General
-
Target
free amongus no virus.exe
-
Size
659KB
-
Sample
220620-t1ahhshad7
-
MD5
21cb738e372351de0abf0f5bc532ab2c
-
SHA1
af006c081c76f91866f377059db52576478aab82
-
SHA256
9f95c22d51882e238da73706c58c9903b4f8543b8dbc549c8b01f9d3b4210165
-
SHA512
308150556c89f262b74130c0548c134bc1e0ad4e29dd04500e297f53b15988fb3f79cda8a0dafeb225a8ceac1bec5ccfd57a88d02d16dbb82e29d5d703e4cde8
Behavioral task
behavioral1
Sample
free amongus no virus.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
Sazan
sussysdfffdfff343.duckdns.org:1604
DC_MUTEX-TUY24DX
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
TPTxFZiBzSR9
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
free amongus no virus.exe
-
Size
659KB
-
MD5
21cb738e372351de0abf0f5bc532ab2c
-
SHA1
af006c081c76f91866f377059db52576478aab82
-
SHA256
9f95c22d51882e238da73706c58c9903b4f8543b8dbc549c8b01f9d3b4210165
-
SHA512
308150556c89f262b74130c0548c134bc1e0ad4e29dd04500e297f53b15988fb3f79cda8a0dafeb225a8ceac1bec5ccfd57a88d02d16dbb82e29d5d703e4cde8
-
Modifies WinLogon for persistence
-
Modifies security service
-
suricata: ET MALWARE Backdoor.Win32.DarkComet Screenshot Upload Successful
suricata: ET MALWARE Backdoor.Win32.DarkComet Screenshot Upload Successful
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-