Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9105e1f225cd922a680e606f874ee5421b113db59fcbcf698de8b00f0bf75346
-
Size
660KB
-
Sample
221201-l1n2xagb89
-
MD5
9a18872af04f4363a3f4ee0defa11f7a
-
SHA1
db898c1154c003f04b1a6016a60fbc1fe3a3b598
-
SHA256
9105e1f225cd922a680e606f874ee5421b113db59fcbcf698de8b00f0bf75346
-
SHA512
2564c14475e5922d30cbd5e0dd825ff0e11d5f466dd7d841d463ad92edea631b42c881980c0e54dfa706fe49de1823c29ae9e682aca264e8f9e801485a09909e
-
SSDEEP
12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uj:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jz
Behavioral task
behavioral1
Sample
9105e1f225cd922a680e606f874ee5421b113db59fcbcf698de8b00f0bf75346.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9105e1f225cd922a680e606f874ee5421b113db59fcbcf698de8b00f0bf75346.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
darkcomet
Guest16_min
nkbh777.no-ip.biz:1604
DCMIN_MUTEX-EU7WNUQ
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
96uknNp9wUQe
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Targets
-
-
Target
9105e1f225cd922a680e606f874ee5421b113db59fcbcf698de8b00f0bf75346
-
Size
660KB
-
MD5
9a18872af04f4363a3f4ee0defa11f7a
-
SHA1
db898c1154c003f04b1a6016a60fbc1fe3a3b598
-
SHA256
9105e1f225cd922a680e606f874ee5421b113db59fcbcf698de8b00f0bf75346
-
SHA512
2564c14475e5922d30cbd5e0dd825ff0e11d5f466dd7d841d463ad92edea631b42c881980c0e54dfa706fe49de1823c29ae9e682aca264e8f9e801485a09909e
-
SSDEEP
12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uj:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jz
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-