General
-
Target
NeptuneClient.exe
-
Size
663KB
-
Sample
240309-x77ndagg8s
-
MD5
2e5c6aa1fb45422ca7411a76901abad0
-
SHA1
f33e086464ff9727c61dace2d2de45ed57abbae9
-
SHA256
72a73dc938994f7426f53815af73c89a04ce96094bceeef83b4810bd3d69fef3
-
SHA512
9a2e150433c7047812b4950d3ce5e30f07a2b017b4a0f61be01fcd1eed4800b82576b38dbc641e380f21491cbfee108ca4fd89838101e3b1c2ea19255b45912f
-
SSDEEP
12288:29HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hy:SZ1xuVVjfFoynPaVBUR8f+kN10EBw
Behavioral task
behavioral1
Sample
NeptuneClient.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
darkcomet
Sazan
inspiring-moon-99738.pktriot.net:22710
DC_MUTEX-PVB2U01
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
glfikLGHfVF2
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
NeptuneClient.exe
-
Size
663KB
-
MD5
2e5c6aa1fb45422ca7411a76901abad0
-
SHA1
f33e086464ff9727c61dace2d2de45ed57abbae9
-
SHA256
72a73dc938994f7426f53815af73c89a04ce96094bceeef83b4810bd3d69fef3
-
SHA512
9a2e150433c7047812b4950d3ce5e30f07a2b017b4a0f61be01fcd1eed4800b82576b38dbc641e380f21491cbfee108ca4fd89838101e3b1c2ea19255b45912f
-
SSDEEP
12288:29HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hy:SZ1xuVVjfFoynPaVBUR8f+kN10EBw
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-