General
-
Target
e3166c851d3b42c5795a022dbf4ac991032e2b84fb1376f4fad1c8da0b43af33
-
Size
349KB
-
Sample
221106-nff7nshbf9
-
MD5
9b76254653754c7c8d3666ee24578a9a
-
SHA1
56e043bedeb56619f6787faa855effbf461b5dac
-
SHA256
e3166c851d3b42c5795a022dbf4ac991032e2b84fb1376f4fad1c8da0b43af33
-
SHA512
5a16e06678e4c9a68a9729b7758349cf57610a6b7b5ffa7b1d0865651d9a4f7b702e1229c7f6080e0f63ced30b03dfca2767f6e7e438e27acb7900bc867937a0
-
SSDEEP
6144:ZcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37YfKMd9mjO5:ZcW7KEZlPzCy37aKMuk
Behavioral task
behavioral1
Sample
e3166c851d3b42c5795a022dbf4ac991032e2b84fb1376f4fad1c8da0b43af33.exe
Resource
win7-20220901-en
Malware Config
Extracted
darkcomet
Guest16
belial.no-ip.org:1604
DC_MUTEX-Z8Q50WZ
-
InstallPath
msdcsc.exe
-
gencode
hXHEm8otYKKu
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
e3166c851d3b42c5795a022dbf4ac991032e2b84fb1376f4fad1c8da0b43af33
-
Size
349KB
-
MD5
9b76254653754c7c8d3666ee24578a9a
-
SHA1
56e043bedeb56619f6787faa855effbf461b5dac
-
SHA256
e3166c851d3b42c5795a022dbf4ac991032e2b84fb1376f4fad1c8da0b43af33
-
SHA512
5a16e06678e4c9a68a9729b7758349cf57610a6b7b5ffa7b1d0865651d9a4f7b702e1229c7f6080e0f63ced30b03dfca2767f6e7e438e27acb7900bc867937a0
-
SSDEEP
6144:ZcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37YfKMd9mjO5:ZcW7KEZlPzCy37aKMuk
-
Modifies WinLogon for persistence
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-