General
-
Target
65f824de5900d920c741dc5f5318684e38d5f329f43c16b5f3e4dd785efef502
-
Size
251KB
-
Sample
221107-the1aahbek
-
MD5
016d3fe0686ab8742664f0156daebc41
-
SHA1
f654106896f8f6d16e934071d17547505ca0dbbf
-
SHA256
65f824de5900d920c741dc5f5318684e38d5f329f43c16b5f3e4dd785efef502
-
SHA512
af4e94606df5ee4f75063786eb43242e97fda8e7311c0559eb3bf0700fd4e94464ead74a1bf6502e489923de05fede73cd58f6baa54e172b96924167e85484fb
-
SSDEEP
6144:5cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37K:5cW7KEZlPzCy37
Behavioral task
behavioral1
Sample
65f824de5900d920c741dc5f5318684e38d5f329f43c16b5f3e4dd785efef502.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Slaves
127.0.0.1:1604
DC_MUTEX-8QVULGQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
ewkRQUkzfyPn
-
install
true
-
offline_keylogger
false
-
password
123
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
65f824de5900d920c741dc5f5318684e38d5f329f43c16b5f3e4dd785efef502
-
Size
251KB
-
MD5
016d3fe0686ab8742664f0156daebc41
-
SHA1
f654106896f8f6d16e934071d17547505ca0dbbf
-
SHA256
65f824de5900d920c741dc5f5318684e38d5f329f43c16b5f3e4dd785efef502
-
SHA512
af4e94606df5ee4f75063786eb43242e97fda8e7311c0559eb3bf0700fd4e94464ead74a1bf6502e489923de05fede73cd58f6baa54e172b96924167e85484fb
-
SSDEEP
6144:5cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37K:5cW7KEZlPzCy37
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-