General
-
Target
689d3b376444629b2db7f4f4bbf194b0
-
Size
601KB
-
Sample
240119-znn32aead5
-
MD5
689d3b376444629b2db7f4f4bbf194b0
-
SHA1
89361e65979066937b7d24720ac8e5a107cfc60e
-
SHA256
57e57b8eefd5a9f717396871df8bb5572ec6b94ab0985a551c838414317bebda
-
SHA512
94831e1a8625c8c11ff30a68870ddea0a71dcfbf1667939b12f6432ec0dfd66a609a51dd5008e15a381bc4632bb6940ed85abdcea48e505b5f78cb20ba8c9c61
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqL2OlxFzU+RaO0kxDRu0h1nGiJdZttE37U6I:tthEVaPqL2OlXPfLNhPGgdleI
Behavioral task
behavioral1
Sample
689d3b376444629b2db7f4f4bbf194b0.exe
Resource
win7-20231215-en
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-F54S21D
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
HAC9L4KeLiZp
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
689d3b376444629b2db7f4f4bbf194b0
-
Size
601KB
-
MD5
689d3b376444629b2db7f4f4bbf194b0
-
SHA1
89361e65979066937b7d24720ac8e5a107cfc60e
-
SHA256
57e57b8eefd5a9f717396871df8bb5572ec6b94ab0985a551c838414317bebda
-
SHA512
94831e1a8625c8c11ff30a68870ddea0a71dcfbf1667939b12f6432ec0dfd66a609a51dd5008e15a381bc4632bb6940ed85abdcea48e505b5f78cb20ba8c9c61
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqL2OlxFzU+RaO0kxDRu0h1nGiJdZttE37U6I:tthEVaPqL2OlXPfLNhPGgdleI
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2