General
-
Target
7a626b02f7f45a8317cb31bc5f6806449a8002d866debef7d77e61a1c141abb1
-
Size
397KB
-
Sample
220919-dcqxlahbbm
-
MD5
a3005dbc2af1969fb5ea9845c884f0a4
-
SHA1
25299b9e82af3898d004832d31c41a8832550265
-
SHA256
7a626b02f7f45a8317cb31bc5f6806449a8002d866debef7d77e61a1c141abb1
-
SHA512
ebd0748653210fb64fa944d421141bbfededfafa5578b88050076fea420bfb25ff19ea609d663d775f931d5d66d88ee7b1cbacfbbf5f2f8f28a194dbee8a6e02
-
SSDEEP
12288:glYzCv9CKflGn/kpeeu5j/NVfW3LFgO6X1qi:gleCJoDFVf0Zgl
Static task
static1
Behavioral task
behavioral1
Sample
7a626b02f7f45a8317cb31bc5f6806449a8002d866debef7d77e61a1c141abb1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a626b02f7f45a8317cb31bc5f6806449a8002d866debef7d77e61a1c141abb1.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
darkcomet
Guest16
hacktyler.ddns.net:1604
DC_MUTEX-7RWPNGS
-
InstallPath
WindowsUpdate/MicroUpdate.exe
-
gencode
vlK5sZi6wYEs
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
7a626b02f7f45a8317cb31bc5f6806449a8002d866debef7d77e61a1c141abb1
-
Size
397KB
-
MD5
a3005dbc2af1969fb5ea9845c884f0a4
-
SHA1
25299b9e82af3898d004832d31c41a8832550265
-
SHA256
7a626b02f7f45a8317cb31bc5f6806449a8002d866debef7d77e61a1c141abb1
-
SHA512
ebd0748653210fb64fa944d421141bbfededfafa5578b88050076fea420bfb25ff19ea609d663d775f931d5d66d88ee7b1cbacfbbf5f2f8f28a194dbee8a6e02
-
SSDEEP
12288:glYzCv9CKflGn/kpeeu5j/NVfW3LFgO6X1qi:gleCJoDFVf0Zgl
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-