General
-
Target
abd6e01a50393d49ccf055013c9347add2a83e2e735e52aefd9fce1c9f0c868f
-
Size
604KB
-
Sample
221123-sx28pace43
-
MD5
dc25d3ac1d767c4d12879c89602acfcb
-
SHA1
53464889ff3e1792094e3ceb065539fccc82e9fe
-
SHA256
abd6e01a50393d49ccf055013c9347add2a83e2e735e52aefd9fce1c9f0c868f
-
SHA512
45f707f1b13e36ae008ae75efc4957f1f95cf7098c520b94d6fb854c573e1a72b488a1163d55a47129bf7922fabb8dbd982a04f4d20dfff79a1f178eb896e1b4
-
SSDEEP
12288:nw0S2XJbOAWPnp98pqBlBPh1U35s2dfnRBqU/x4ySG2GR:nnhX0AooO83fdfRwU54yV
Static task
static1
Behavioral task
behavioral1
Sample
abd6e01a50393d49ccf055013c9347add2a83e2e735e52aefd9fce1c9f0c868f.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Victim
jrusse.no-ip.org:5050
DC_MUTEX-SANCFCW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Xl6PgidaJaTh
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
rundll32
Targets
-
-
Target
abd6e01a50393d49ccf055013c9347add2a83e2e735e52aefd9fce1c9f0c868f
-
Size
604KB
-
MD5
dc25d3ac1d767c4d12879c89602acfcb
-
SHA1
53464889ff3e1792094e3ceb065539fccc82e9fe
-
SHA256
abd6e01a50393d49ccf055013c9347add2a83e2e735e52aefd9fce1c9f0c868f
-
SHA512
45f707f1b13e36ae008ae75efc4957f1f95cf7098c520b94d6fb854c573e1a72b488a1163d55a47129bf7922fabb8dbd982a04f4d20dfff79a1f178eb896e1b4
-
SSDEEP
12288:nw0S2XJbOAWPnp98pqBlBPh1U35s2dfnRBqU/x4ySG2GR:nnhX0AooO83fdfRwU54yV
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-