General
-
Target
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
-
Size
1.3MB
-
Sample
221201-lyxahaga57
-
MD5
613ab7ed6c2775609f3c9e7b165004da
-
SHA1
7d303cd2d2fea564dc21f0f68a24ef2258ea60b0
-
SHA256
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
-
SHA512
38a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
SSDEEP
24576:RRmJkcoQricOIQxiZY1ia132cWcOrcEMEsDhec44t+Ry34WyuHOiWSz:eJZoQrbTFZY1ia13ycOYEMbec4E12JiV
Static task
static1
Behavioral task
behavioral1
Sample
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
power
gamesgate.servegame.com:1338
gamesgate.servegame.com:8080
gamesgate.servegame.com:1090
gamesgate.servegame.com:27015
gamesgate.servegame.com:5550
gamesgate.servegame.com:1080
gamesgate.servegame.com:2000
gamesgate.servegame.com:15963
DC_MUTEX-DS3FNSW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6NxBhjX09mvh
-
install
true
-
offline_keylogger
true
-
password
power94
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
-
Size
1.3MB
-
MD5
613ab7ed6c2775609f3c9e7b165004da
-
SHA1
7d303cd2d2fea564dc21f0f68a24ef2258ea60b0
-
SHA256
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
-
SHA512
38a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
SSDEEP
24576:RRmJkcoQricOIQxiZY1ia132cWcOrcEMEsDhec44t+Ry34WyuHOiWSz:eJZoQrbTFZY1ia13ycOYEMbec4E12JiV
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-