General
-
Target
f8c953743723232fd465b173142ebdf43aef121df15b9a962501c759c1f99446
-
Size
349KB
-
Sample
221001-3nar7acbd6
-
MD5
74a3ce4797153d8376da6b3f2b22bdc0
-
SHA1
f9a78fed8215b8bbca5eabc473a6b4fec00f8142
-
SHA256
f8c953743723232fd465b173142ebdf43aef121df15b9a962501c759c1f99446
-
SHA512
d2910a406a01c9535e2f27a5958845b70caa1ff68765b358b0a7d4ad9c8db412a2422ae23c75ad2c44a9e97c984c3672514d88f2d657df9d04941e3e261f4b0c
-
SSDEEP
6144:kcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37isuPlbL:kcW7KEZlPzCy37i
Behavioral task
behavioral1
Sample
f8c953743723232fd465b173142ebdf43aef121df15b9a962501c759c1f99446.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Guest16
5.105.126.91:1604
DC_MUTEX-VR84THX
-
InstallPath
windows.exe
-
gencode
65hHZs77nVG3
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
f8c953743723232fd465b173142ebdf43aef121df15b9a962501c759c1f99446
-
Size
349KB
-
MD5
74a3ce4797153d8376da6b3f2b22bdc0
-
SHA1
f9a78fed8215b8bbca5eabc473a6b4fec00f8142
-
SHA256
f8c953743723232fd465b173142ebdf43aef121df15b9a962501c759c1f99446
-
SHA512
d2910a406a01c9535e2f27a5958845b70caa1ff68765b358b0a7d4ad9c8db412a2422ae23c75ad2c44a9e97c984c3672514d88f2d657df9d04941e3e261f4b0c
-
SSDEEP
6144:kcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37isuPlbL:kcW7KEZlPzCy37i
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-