General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
darkcomet
Botnet
Sazan
C2
loving-darkness-66026.pktriot.net:22134
Mutex
DC_MUTEX-TER0VS3
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
HrqlvFqDzjkC
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
https://www.youtube.com/watch?v=iu19uWF6gwA
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1