General
-
Target
96f5c3b4b81378a06491ff6ee82ab71af01e85a8bea12bef2d49a1d083262198
-
Size
1.3MB
-
Sample
221125-eyks5sed8s
-
MD5
5c81162aa56ef2d826fb9568067b1ba3
-
SHA1
52a1dfb2f44c721b5e788df50b255759c7d3b72e
-
SHA256
96f5c3b4b81378a06491ff6ee82ab71af01e85a8bea12bef2d49a1d083262198
-
SHA512
7dc2660161712176d9de1fb2b6f0cf92d031ff85f1ebf805652d2389e57c96541e55eae18cb477ebf07fa0545df9825ceabc97b07180c5e3d1bfac491c5e6b2b
-
SSDEEP
24576:GfZc4o2V3KorcRP87KdMYWtahGjjd/isDIPW:Gf+4o2YorU8umYYaUjjd/nDIPW
Static task
static1
Behavioral task
behavioral1
Sample
96f5c3b4b81378a06491ff6ee82ab71af01e85a8bea12bef2d49a1d083262198.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
96f5c3b4b81378a06491ff6ee82ab71af01e85a8bea12bef2d49a1d083262198.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
darkcomet
azuka
azuka419.ddns.net:10001
DC_MUTEX-24QP7RP
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
HPdfeX0hFstf
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
96f5c3b4b81378a06491ff6ee82ab71af01e85a8bea12bef2d49a1d083262198
-
Size
1.3MB
-
MD5
5c81162aa56ef2d826fb9568067b1ba3
-
SHA1
52a1dfb2f44c721b5e788df50b255759c7d3b72e
-
SHA256
96f5c3b4b81378a06491ff6ee82ab71af01e85a8bea12bef2d49a1d083262198
-
SHA512
7dc2660161712176d9de1fb2b6f0cf92d031ff85f1ebf805652d2389e57c96541e55eae18cb477ebf07fa0545df9825ceabc97b07180c5e3d1bfac491c5e6b2b
-
SSDEEP
24576:GfZc4o2V3KorcRP87KdMYWtahGjjd/isDIPW:Gf+4o2YorU8umYYaUjjd/nDIPW
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-