General
-
Target
f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18
-
Size
658KB
-
Sample
221126-cfyk6sgg8s
-
MD5
3127bfcb04c1efdf78534610c0f6e46b
-
SHA1
fd0e2e9ea3b1563706145362f9fccb610653d6f9
-
SHA256
f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18
-
SHA512
36119a3e441efc57b2e96e7a7bcb8c3902eec6bb5faf418fc9859ae351e667a0ced45a765ce634dc01e3a1662bddb7a15ea40ac979bd5496935f006e7a0880f1
-
SSDEEP
12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h6:eZ1xuVVjfFoynPaVBUR8f+kN10EB8
Behavioral task
behavioral1
Sample
f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
darkcomet
Victime
23.95.52.24:1604
MUTEX-GURB7WX
-
InstallPath
Microsoft\windowsupdate.com
-
gencode
hkdEYJPYqYa3
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows
Targets
-
-
Target
f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18
-
Size
658KB
-
MD5
3127bfcb04c1efdf78534610c0f6e46b
-
SHA1
fd0e2e9ea3b1563706145362f9fccb610653d6f9
-
SHA256
f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18
-
SHA512
36119a3e441efc57b2e96e7a7bcb8c3902eec6bb5faf418fc9859ae351e667a0ced45a765ce634dc01e3a1662bddb7a15ea40ac979bd5496935f006e7a0880f1
-
SSDEEP
12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h6:eZ1xuVVjfFoynPaVBUR8f+kN10EB8
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-