General
-
Target
61469ca57f2adc1298c401654f480d1a74216bf198fcc4083c4ecb4c915719a5
-
Size
7.6MB
-
Sample
220730-1h9yzshcg5
-
MD5
67e0fbdcc5b4c67ea6020f2a9a3cd66b
-
SHA1
3b62c037ad412deecf638812e66bbddfa05efa35
-
SHA256
61469ca57f2adc1298c401654f480d1a74216bf198fcc4083c4ecb4c915719a5
-
SHA512
abdd972d162d4fae5f1bbe7b8e46b6ad72c1481ec3c448c1a327971a96e87774d2461e4858d19c6874b53ef74bac431e2dd21f6c0d6691a67b0b4b84b6a807f6
Behavioral task
behavioral1
Sample
61469ca57f2adc1298c401654f480d1a74216bf198fcc4083c4ecb4c915719a5.exe
Resource
win7-20220715-en
Malware Config
Extracted
darkcomet
Neo
neoxyne.myvnc.com:1995
DC_MUTEX-RVTKUEQ
-
InstallPath
Google\chromemsdcsc.exe
-
gencode
uiEb6MXxZaxa
-
install
true
-
offline_keylogger
true
-
password
neoxyne1995
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
61469ca57f2adc1298c401654f480d1a74216bf198fcc4083c4ecb4c915719a5
-
Size
7.6MB
-
MD5
67e0fbdcc5b4c67ea6020f2a9a3cd66b
-
SHA1
3b62c037ad412deecf638812e66bbddfa05efa35
-
SHA256
61469ca57f2adc1298c401654f480d1a74216bf198fcc4083c4ecb4c915719a5
-
SHA512
abdd972d162d4fae5f1bbe7b8e46b6ad72c1481ec3c448c1a327971a96e87774d2461e4858d19c6874b53ef74bac431e2dd21f6c0d6691a67b0b4b84b6a807f6
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-