General
-
Target
a2d08a4029421bb1d843c7207e454a16cfc0236900e3a409923bb8080aa035a7
-
Size
702KB
-
Sample
221125-kdc6fsdf79
-
MD5
cd0bcac8c581301eefe84b33ca925aa2
-
SHA1
6dacf457b9ebad5a94c63352a980fea77e2e4174
-
SHA256
a2d08a4029421bb1d843c7207e454a16cfc0236900e3a409923bb8080aa035a7
-
SHA512
7da261fc38ea27a54afe2fcade90a9088a104028af44c13d952d083612c017acdefa8380c7b46e47e051d3a3da1e3700d5fd12eaf144ecb3559835330486d6ed
-
SSDEEP
12288:JcrNS33L10QdrXZT+tcWnkTokrukilSxvb6yxlmpGx4GrCHg+IGGRzAtn5JUxO:0NA3R5drX/W8XZsSrxlCGJCtIGPt5SY
Static task
static1
Behavioral task
behavioral1
Sample
a2d08a4029421bb1d843c7207e454a16cfc0236900e3a409923bb8080aa035a7.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Guest16
192.62.25.221:16044
deadok.ddns.net:1604
127.0.0.1:1604
0.tcp.ngrok.io:11499
DC_MUTEX-9VCBH8U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
8sLSoeDEUJgz
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
a2d08a4029421bb1d843c7207e454a16cfc0236900e3a409923bb8080aa035a7
-
Size
702KB
-
MD5
cd0bcac8c581301eefe84b33ca925aa2
-
SHA1
6dacf457b9ebad5a94c63352a980fea77e2e4174
-
SHA256
a2d08a4029421bb1d843c7207e454a16cfc0236900e3a409923bb8080aa035a7
-
SHA512
7da261fc38ea27a54afe2fcade90a9088a104028af44c13d952d083612c017acdefa8380c7b46e47e051d3a3da1e3700d5fd12eaf144ecb3559835330486d6ed
-
SSDEEP
12288:JcrNS33L10QdrXZT+tcWnkTokrukilSxvb6yxlmpGx4GrCHg+IGGRzAtn5JUxO:0NA3R5drX/W8XZsSrxlCGJCtIGPt5SY
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-