General
-
Target
loader.bin
-
Size
659KB
-
Sample
220620-xrgr1scge7
-
MD5
559e77c66347f99fc2ab5e9ef757ce0d
-
SHA1
86bd1056e44cdf6dcd3188e16f55cef80a840949
-
SHA256
8d5f887270c6f0c2b383c57435bbf7d222ce416a09b3d74d4e1d80608543d0ce
-
SHA512
30f67914a11b57dd69d4f2715c03477d934442169db37c5b74e91d0fb8cbf00b3d4fbd94a38b3ed456b9363d551e2b22756087c19cea53eb3da52eb5fd8515e9
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
Sazan
sussysdfffdfff343.duckdns.org:1604
DC_MUTEX-LJTACQW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
l51rypEngfWg
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
loader.bin
-
Size
659KB
-
MD5
559e77c66347f99fc2ab5e9ef757ce0d
-
SHA1
86bd1056e44cdf6dcd3188e16f55cef80a840949
-
SHA256
8d5f887270c6f0c2b383c57435bbf7d222ce416a09b3d74d4e1d80608543d0ce
-
SHA512
30f67914a11b57dd69d4f2715c03477d934442169db37c5b74e91d0fb8cbf00b3d4fbd94a38b3ed456b9363d551e2b22756087c19cea53eb3da52eb5fd8515e9
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-