General
-
Target
0ae77ca6b52c2577d51bba8862dcc92677a1ad07ed4ec4a8357583f5a1ee84f3
-
Size
424KB
-
Sample
221011-lavf1afge5
-
MD5
6d280f7244c4e44953faa8441ee43c00
-
SHA1
728b8549229046190da4888d76333ec59fe02d1d
-
SHA256
0ae77ca6b52c2577d51bba8862dcc92677a1ad07ed4ec4a8357583f5a1ee84f3
-
SHA512
7bdd319c840199dfb20703497e852bab2cefce875ee2ad0aa265192c73c0bbf0b96b217dba0a1e308226471a336d7abe9a3af375cc011a676a092a192d96b99d
-
SSDEEP
6144:ScNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37b9Xv7JHqQGt8U:ScW7KEZlPzCy37BXN4
Behavioral task
behavioral1
Sample
0ae77ca6b52c2577d51bba8862dcc92677a1ad07ed4ec4a8357583f5a1ee84f3.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Guest16
tonytony11.no-ip.org:1604
DC_MUTEX-V53C7NX
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
vSaspT4tAJHM
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows.exe
Targets
-
-
Target
0ae77ca6b52c2577d51bba8862dcc92677a1ad07ed4ec4a8357583f5a1ee84f3
-
Size
424KB
-
MD5
6d280f7244c4e44953faa8441ee43c00
-
SHA1
728b8549229046190da4888d76333ec59fe02d1d
-
SHA256
0ae77ca6b52c2577d51bba8862dcc92677a1ad07ed4ec4a8357583f5a1ee84f3
-
SHA512
7bdd319c840199dfb20703497e852bab2cefce875ee2ad0aa265192c73c0bbf0b96b217dba0a1e308226471a336d7abe9a3af375cc011a676a092a192d96b99d
-
SSDEEP
6144:ScNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37b9Xv7JHqQGt8U:ScW7KEZlPzCy37BXN4
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-