General
-
Target
1185a0ec37d0edaba196a73f3b2f9df0126caca14011876c34f375ef3a974318
-
Size
283KB
-
Sample
220725-ajh9jsega6
-
MD5
9c40dc626ff68bd1b114b266ad83aaaa
-
SHA1
4852aa302d72519f443bff5fa14ae44bec7183a2
-
SHA256
1185a0ec37d0edaba196a73f3b2f9df0126caca14011876c34f375ef3a974318
-
SHA512
c09773f312edf242b4071a9eb42e634db36587ebf53e5430ab95ff1421a327fe7b7f909be03279d65db58a335c3958960a96e29c342f926b90e0d70cf54f93cd
Behavioral task
behavioral1
Sample
1185a0ec37d0edaba196a73f3b2f9df0126caca14011876c34f375ef3a974318.exe
Resource
win7-20220718-en
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:888
DC_MUTEX-7X1Q8Z3
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6Rm4GrjxWWjW
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
1185a0ec37d0edaba196a73f3b2f9df0126caca14011876c34f375ef3a974318
-
Size
283KB
-
MD5
9c40dc626ff68bd1b114b266ad83aaaa
-
SHA1
4852aa302d72519f443bff5fa14ae44bec7183a2
-
SHA256
1185a0ec37d0edaba196a73f3b2f9df0126caca14011876c34f375ef3a974318
-
SHA512
c09773f312edf242b4071a9eb42e634db36587ebf53e5430ab95ff1421a327fe7b7f909be03279d65db58a335c3958960a96e29c342f926b90e0d70cf54f93cd
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-