General
-
Target
2ae7eb3e138feab1512929f01d85bec8f2f1f941798f8c994002c479591afccd
-
Size
658KB
-
Sample
220725-f1va2agebj
-
MD5
8b2343d0b1e7d35b30b402478387da19
-
SHA1
43adb71190172e05cda78a05f8643d0fe7a8c332
-
SHA256
2ae7eb3e138feab1512929f01d85bec8f2f1f941798f8c994002c479591afccd
-
SHA512
1bc38d51419909efcc438a1d77825514fdd251ddcfe50223c116ac3cb9d53466f8b773cea467918413315753db75c2204226a371b673363dc93ab80cd92d3478
Behavioral task
behavioral1
Sample
2ae7eb3e138feab1512929f01d85bec8f2f1f941798f8c994002c479591afccd.exe
Resource
win7-20220715-en
Malware Config
Extracted
darkcomet
ALL
192.168.1.43:6666
DC_MUTEX-0ZMB0MX
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
iGiHgd2SDyqC
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
2ae7eb3e138feab1512929f01d85bec8f2f1f941798f8c994002c479591afccd
-
Size
658KB
-
MD5
8b2343d0b1e7d35b30b402478387da19
-
SHA1
43adb71190172e05cda78a05f8643d0fe7a8c332
-
SHA256
2ae7eb3e138feab1512929f01d85bec8f2f1f941798f8c994002c479591afccd
-
SHA512
1bc38d51419909efcc438a1d77825514fdd251ddcfe50223c116ac3cb9d53466f8b773cea467918413315753db75c2204226a371b673363dc93ab80cd92d3478
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-