General
-
Target
8340bd9cd59f5d01147809a40b97255fca021236fb5301768cf745de300fa14e
-
Size
1.1MB
-
Sample
221029-wm78qshaf7
-
MD5
845ee02217cc02dbe8b0fc34859d7d88
-
SHA1
a50ef3d978ac9f57cbf1b3ba0370b1927f66a381
-
SHA256
8340bd9cd59f5d01147809a40b97255fca021236fb5301768cf745de300fa14e
-
SHA512
a4fd57a1622c8d8671650bded95f15d44d8656d0a5ca055653abee9fee031903a5832262d55c7a2f736fc3851721b230411a70cb82850ba07c8b67ee9a4f7499
-
SSDEEP
24576:JTOpHCJKeZeDj7ywX0Mf5ST58ZTOpHPuWvygQlnjqMf5ST58p:RKeQzywX0mcTgBYQZqmcTo
Static task
static1
Behavioral task
behavioral1
Sample
8340bd9cd59f5d01147809a40b97255fca021236fb5301768cf745de300fa14e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8340bd9cd59f5d01147809a40b97255fca021236fb5301768cf745de300fa14e.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
darkcomet
Bot
rangekid15.no-ip.info:201
DC_MUTEX-1PZGZJC
-
InstallPath
7899833/2938392.exe
-
gencode
fZH04UXY1pT3
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows.dll
Targets
-
-
Target
8340bd9cd59f5d01147809a40b97255fca021236fb5301768cf745de300fa14e
-
Size
1.1MB
-
MD5
845ee02217cc02dbe8b0fc34859d7d88
-
SHA1
a50ef3d978ac9f57cbf1b3ba0370b1927f66a381
-
SHA256
8340bd9cd59f5d01147809a40b97255fca021236fb5301768cf745de300fa14e
-
SHA512
a4fd57a1622c8d8671650bded95f15d44d8656d0a5ca055653abee9fee031903a5832262d55c7a2f736fc3851721b230411a70cb82850ba07c8b67ee9a4f7499
-
SSDEEP
24576:JTOpHCJKeZeDj7ywX0Mf5ST58ZTOpHPuWvygQlnjqMf5ST58p:RKeQzywX0mcTgBYQZqmcTo
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-