General
-
Target
5f21d2aab871c215f1b4e71b275359144d0e730533596c3822732a7fe6d70759
-
Size
908KB
-
Sample
220731-wrmgtsbghn
-
MD5
4b1f7a301abc074183a29f7ef6d938c4
-
SHA1
a3072f0792f241a1c91da5d17827799701f6492d
-
SHA256
5f21d2aab871c215f1b4e71b275359144d0e730533596c3822732a7fe6d70759
-
SHA512
00a4818570a87faa2427c3101eecc64dd405d3bd12aaf91bb6f8ccfc69fdcfd13ad06eec83d1c1db964fca3341113f5cbc7d934ccc32b075d466af9fa03778ce
Static task
static1
Behavioral task
behavioral1
Sample
5f21d2aab871c215f1b4e71b275359144d0e730533596c3822732a7fe6d70759.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5f21d2aab871c215f1b4e71b275359144d0e730533596c3822732a7fe6d70759.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
darkcomet
Guest16_min
192.168.0.111:1604
DCMIN_MUTEX-B93YPDE
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
YZNRaKfSZ1x2
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Targets
-
-
Target
5f21d2aab871c215f1b4e71b275359144d0e730533596c3822732a7fe6d70759
-
Size
908KB
-
MD5
4b1f7a301abc074183a29f7ef6d938c4
-
SHA1
a3072f0792f241a1c91da5d17827799701f6492d
-
SHA256
5f21d2aab871c215f1b4e71b275359144d0e730533596c3822732a7fe6d70759
-
SHA512
00a4818570a87faa2427c3101eecc64dd405d3bd12aaf91bb6f8ccfc69fdcfd13ad06eec83d1c1db964fca3341113f5cbc7d934ccc32b075d466af9fa03778ce
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-