General
-
Target
53f9da2780b6f5a90cfa960a7ba80eef.exe
-
Size
1.3MB
-
Sample
240111-ytw56afcam
-
MD5
53f9da2780b6f5a90cfa960a7ba80eef
-
SHA1
797377e262f78ebcbb50203a286fdcbc76b45e81
-
SHA256
4764430a1dcd759ca63408103232d28a82c2e1ae3c1cc29a536fecdee9171fb3
-
SHA512
bced0651108eecdad60f6b9291e065877f9b7b43ae5edbf659d6028c192de918f11e8d6019cc5e287f9036f33825c52f5b34fce58d4d76f02c834aa16dfdaa41
-
SSDEEP
24576:Vt3Neacap5W/4UHRY2FhJvQywVLjaGVOUN6nyhkHgKU6Y:VtUaAwls+9j4HgK
Static task
static1
Behavioral task
behavioral1
Sample
53f9da2780b6f5a90cfa960a7ba80eef.exe
Resource
win7-20231129-en
Malware Config
Extracted
darkcomet
slave
ratting.no-ip.org:1605
DC_MUTEX-Q21PSYS
-
gencode
3xN2KEijP0Bj
-
install
false
-
offline_keylogger
true
-
password
darkcomet
-
persistence
false
Targets
-
-
Target
53f9da2780b6f5a90cfa960a7ba80eef.exe
-
Size
1.3MB
-
MD5
53f9da2780b6f5a90cfa960a7ba80eef
-
SHA1
797377e262f78ebcbb50203a286fdcbc76b45e81
-
SHA256
4764430a1dcd759ca63408103232d28a82c2e1ae3c1cc29a536fecdee9171fb3
-
SHA512
bced0651108eecdad60f6b9291e065877f9b7b43ae5edbf659d6028c192de918f11e8d6019cc5e287f9036f33825c52f5b34fce58d4d76f02c834aa16dfdaa41
-
SSDEEP
24576:Vt3Neacap5W/4UHRY2FhJvQywVLjaGVOUN6nyhkHgKU6Y:VtUaAwls+9j4HgK
-
Disables RegEdit via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1