General
-
Target
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
-
Size
975KB
-
Sample
240315-vk48mafg73
-
MD5
af7484c40877c3d74d58100509797f71
-
SHA1
70cd03800362f1b35dc5260642ebf7d2159f18b8
-
SHA256
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
-
SHA512
b964f8277222df462ffd60b321ce856bdc4956234171bd8ea57dff4adfa02a07d0101e52eb5e5db5684a5b3f56b6ec67cadb10db9fb87b8d51affe8cba9220e1
-
SSDEEP
12288:W9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hlx3st:yZ1xuVVjfFoynPaVBUR8f+kN10EBDBst
Behavioral task
behavioral1
Sample
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe
Resource
win7-20240221-en
Malware Config
Extracted
darkcomet
Guest16
nakaga.ddns.net:1604
DC_MUTEX-4A2S168
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
pkmsYsbr22Ni
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
-
Size
975KB
-
MD5
af7484c40877c3d74d58100509797f71
-
SHA1
70cd03800362f1b35dc5260642ebf7d2159f18b8
-
SHA256
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
-
SHA512
b964f8277222df462ffd60b321ce856bdc4956234171bd8ea57dff4adfa02a07d0101e52eb5e5db5684a5b3f56b6ec67cadb10db9fb87b8d51affe8cba9220e1
-
SSDEEP
12288:W9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hlx3st:yZ1xuVVjfFoynPaVBUR8f+kN10EBDBst
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2