General
-
Target
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
-
Size
690KB
-
Sample
220725-ajm8hafabr
-
MD5
b5bdc77d7de04cee9d59999367b19759
-
SHA1
362fb65eb92228033d0f1f263ad26a33a43a443f
-
SHA256
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
-
SHA512
ad4e94c0a3fdc48efde1294d54004c89f07b36bb109a41826942a018b44030690a4d381e26992082dedd3dcfbe05c6ed4ef4523b11ea7758fc6691a00a8cb195
Behavioral task
behavioral1
Sample
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe
Resource
win7-20220718-en
Malware Config
Extracted
darkcomet
Yarik
kolgah.ddns.net:1604
DC_MUTEX-YM0NEUT
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
pozsQkwcSLKX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
-
Size
690KB
-
MD5
b5bdc77d7de04cee9d59999367b19759
-
SHA1
362fb65eb92228033d0f1f263ad26a33a43a443f
-
SHA256
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
-
SHA512
ad4e94c0a3fdc48efde1294d54004c89f07b36bb109a41826942a018b44030690a4d381e26992082dedd3dcfbe05c6ed4ef4523b11ea7758fc6691a00a8cb195
-
Modifies WinLogon for persistence
-
Modifies security service
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-