General
-
Target
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
-
Size
927KB
-
Sample
221004-dg1btsaac2
-
MD5
6d5416776bd0f3854a271722098d719e
-
SHA1
ff6876a938916d3010963136ef8b084f0d703b5d
-
SHA256
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
-
SHA512
3fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
SSDEEP
24576:NZPMSPOdEDGD8Xa6x4LqKMg1tXykjBUyNts4cPq:DOv8XFKLx1tisNFh
Static task
static1
Behavioral task
behavioral1
Sample
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
darkcomet
Guest16
109.104.87.142:2039
DC_MUTEX-X2C2Y2U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
FcUN6bdTNYgc
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Extracted
darkcomet
CryptService
bezerkmedia.no-ip.biz:1606
DCMIN_MUTEX-97A2GT7
-
gencode
0n1bb6xQeSjV
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
-
Size
927KB
-
MD5
6d5416776bd0f3854a271722098d719e
-
SHA1
ff6876a938916d3010963136ef8b084f0d703b5d
-
SHA256
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
-
SHA512
3fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
SSDEEP
24576:NZPMSPOdEDGD8Xa6x4LqKMg1tXykjBUyNts4cPq:DOv8XFKLx1tisNFh
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-