darkcomet | 764-70-0x0000000000400000-0x00000000004B5000-memory[.]dmp

General

Target
764-70-0x0000000000400000-0x00000000004B5000-memory.dmp
Size 724KB
Sample221009-1nafbaaab8
SHA256 ed7ad9590fea266453eb384e80c697930ae26718ecc7bfdcf117db6e4d35bb1a
MD5 9b9bd23d8c71c022fccdb9694c06f1a2
SHA1 d483c79251147dc310ecbb5b66ea072f47de477a
SHA512 e26ccc9837f8186daf46995ea6a5374ed54029c308c6c0831ad621fa0c7ef352c49eb806536af695f1e0a479f2524b2f79e9773b939f0205a099ce7a2767b686
SSDEEP 12288:69HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkPI/:2Z1xuVVjfFoynPaVBUR8f+kN10Ed
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guest16 darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

dnsali.3utilities.com:1604

Mutex

DC_MUTEX-S3VT824

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
aedfreoKqqaC
install
true
offline_keylogger
true
password
12022005
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet family
darkcomet

File Explorer

764-70-0x0000000000400000-0x00000000004B5000-memory.dmp

.exe 724KB

764-70-0x0000000000400000-0x00000000004B5000-memory.dmp

SHA256 ed7ad9590fea266453eb384e80c697930ae26718ecc7bfdcf117db6e4d35bb1a
MD5 9b9bd23d8c71c022fccdb9694c06f1a2
SHA1 d483c79251147dc310ecbb5b66ea072f47de477a
SHA512 e26ccc9837f8186daf46995ea6a5374ed54029c308c6c0831ad621fa0c7ef352c49eb806536af695f1e0a479f2524b2f79e9773b939f0205a099ce7a2767b686
SSDEEP 12288:69HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkPI/:2Z1xuVVjfFoynPaVBUR8f+kN10Ed
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

730669

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Sharing