General
-
Target
1b306c2602d71c1b39a6972d2c8607e544edb2eeab17b423729a0c1b0f340f3f
-
Size
690KB
-
Sample
220630-xqbjlshagm
-
MD5
3a22854e13ec22a99aaf693ca81d2898
-
SHA1
8c59c824bc38b6aa0f2310752b4d6c96104f40a4
-
SHA256
1b306c2602d71c1b39a6972d2c8607e544edb2eeab17b423729a0c1b0f340f3f
-
SHA512
ca18233f933509679c74469a23487c5bb3f9e7a48aca9ba98e76d7201b679097c1af4aadf77ef3dbbee1d008d8806d418eb9c7c4fd0a85c38bf4b9d7b726a9fa
Behavioral task
behavioral1
Sample
1b306c2602d71c1b39a6972d2c8607e544edb2eeab17b423729a0c1b0f340f3f.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
ALL
78.179.195.97:1604
DC_MUTEX-G42FP02
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
AYYXG1rhBfzD
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
1b306c2602d71c1b39a6972d2c8607e544edb2eeab17b423729a0c1b0f340f3f
-
Size
690KB
-
MD5
3a22854e13ec22a99aaf693ca81d2898
-
SHA1
8c59c824bc38b6aa0f2310752b4d6c96104f40a4
-
SHA256
1b306c2602d71c1b39a6972d2c8607e544edb2eeab17b423729a0c1b0f340f3f
-
SHA512
ca18233f933509679c74469a23487c5bb3f9e7a48aca9ba98e76d7201b679097c1af4aadf77ef3dbbee1d008d8806d418eb9c7c4fd0a85c38bf4b9d7b726a9fa
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-