General
-
Target
çoktehlikelirat.exe
-
Size
658KB
-
Sample
220826-p6b63sdgb6
-
MD5
e897235ce886b3499efbb0432e88a322
-
SHA1
c6c1c438826d4b8b48961e81befe35dbd63a7793
-
SHA256
f848632cde166bb8288dfc4478c0b76c9026880d8fbb272e9ea91fdbc4ed6b65
-
SHA512
32dbdfb29236c029621575431442248b050a64a8eed5c0bbd0ec5570153cfd0c5e30044d1549a56806adc12534c3640ca83a76a7c2a05ea04485897bdd969ccf
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hR:KZ1xuVVjfFoynPaVBUR8f+kN10EBn
Behavioral task
behavioral1
Sample
çoktehlikelirat.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Guest16
sussysdfffdfff343.duckdns.org:1604
DC_MUTEX-UG98WBU
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
T3UvztfCGQqb
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
çoktehlikelirat.exe
-
Size
658KB
-
MD5
e897235ce886b3499efbb0432e88a322
-
SHA1
c6c1c438826d4b8b48961e81befe35dbd63a7793
-
SHA256
f848632cde166bb8288dfc4478c0b76c9026880d8fbb272e9ea91fdbc4ed6b65
-
SHA512
32dbdfb29236c029621575431442248b050a64a8eed5c0bbd0ec5570153cfd0c5e30044d1549a56806adc12534c3640ca83a76a7c2a05ea04485897bdd969ccf
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hR:KZ1xuVVjfFoynPaVBUR8f+kN10EBn
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-