General
-
Target
2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b
-
Size
674KB
-
Sample
221011-k9p5wsfgb6
-
MD5
6b0a485a1d738b5e8f8b5cc6f89f9770
-
SHA1
cbbb17136c1d24a5a4891825a9e381e0df84142d
-
SHA256
2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b
-
SHA512
0315b3849fe665795ca2784e3cd3bd43a61f7aa6ab216fdad076b8a2f92e966a10786ace416f5a368c5586041c14792c062a4a64f608ef48e48f8beb3c5f27e0
-
SSDEEP
12288:w9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hb:UZ1xuVVjfFoynPaVBUR8f+kN10EBV
Behavioral task
behavioral1
Sample
2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Guest16
scan247.noip.me:1984
DC_MUTEX-4RAP6WL
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
YbQjH7ZVU9Cr
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b
-
Size
674KB
-
MD5
6b0a485a1d738b5e8f8b5cc6f89f9770
-
SHA1
cbbb17136c1d24a5a4891825a9e381e0df84142d
-
SHA256
2809893f2a1de244c536400876945e61f191c679084c32a0387ed06df256b06b
-
SHA512
0315b3849fe665795ca2784e3cd3bd43a61f7aa6ab216fdad076b8a2f92e966a10786ace416f5a368c5586041c14792c062a4a64f608ef48e48f8beb3c5f27e0
-
SSDEEP
12288:w9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hb:UZ1xuVVjfFoynPaVBUR8f+kN10EBV
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-