General
-
Target
9fc730001f0b9de1015cb0544c3cc775
-
Size
1.2MB
-
Sample
240216-h97c3ada8z
-
MD5
9fc730001f0b9de1015cb0544c3cc775
-
SHA1
180cafcff5843da1bb4e6b898007352bd8f7422a
-
SHA256
25e21ed65dbb774bf9ba33bc6ed82ada407e2e47d9333bf983aadcef5ae6828a
-
SHA512
89e0b6fb131af80a313fc6c4ef61e937b46173b75f868f1110cf8b3724b9503c62c205c5a2509edae0ada6cfc6a56e6d078ca8c4f1d20e3f6b680be4b3377302
-
SSDEEP
24576:RmJuqft9oiO8jrzI1LmpqoTYo7IOUAF7/cfg/c10tcT4QqiBmxf0:RmleejUm4Lsxc
Static task
static1
Behavioral task
behavioral1
Sample
9fc730001f0b9de1015cb0544c3cc775.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9fc730001f0b9de1015cb0544c3cc775.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
darkcomet
Guest16
alrdmh1.no-ip.info:1604
DC_MUTEX-T32EFR2
-
InstallPath
MSDCSC\ssms.exe
-
gencode
d3jVJWfh6uR6
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
9fc730001f0b9de1015cb0544c3cc775
-
Size
1.2MB
-
MD5
9fc730001f0b9de1015cb0544c3cc775
-
SHA1
180cafcff5843da1bb4e6b898007352bd8f7422a
-
SHA256
25e21ed65dbb774bf9ba33bc6ed82ada407e2e47d9333bf983aadcef5ae6828a
-
SHA512
89e0b6fb131af80a313fc6c4ef61e937b46173b75f868f1110cf8b3724b9503c62c205c5a2509edae0ada6cfc6a56e6d078ca8c4f1d20e3f6b680be4b3377302
-
SSDEEP
24576:RmJuqft9oiO8jrzI1LmpqoTYo7IOUAF7/cfg/c10tcT4QqiBmxf0:RmleejUm4Lsxc
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-