General
-
Target
77058147d37749df7378249a128a5298de49787eba629b634090849456774ce8.exe
-
Size
663KB
-
Sample
240411-s637caef69
-
MD5
8231d8d9d1c38a7f2ebce20944bcfc63
-
SHA1
ca190e6cab231bd140dab3a13c7a59cb88c85e7b
-
SHA256
77058147d37749df7378249a128a5298de49787eba629b634090849456774ce8
-
SHA512
8025a7c2231a562bf4d0ff76a813585606462a51a1b76a34d54f0640b4f591d8abdc32928795162f987f6dfd42f16e10c340f27a62ad87b18cec81bdb9a68cc2
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:KZ1xuVVjfFoynPaVBUR8f+kN10Ed
Behavioral task
behavioral1
Sample
77058147d37749df7378249a128a5298de49787eba629b634090849456774ce8.exe
Resource
win7-20240221-en
Malware Config
Extracted
darkcomet
Guest16
80.222.152.67:80
DC_MUTEX-QWMWN2U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
hdQRh37piHv1
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
77058147d37749df7378249a128a5298de49787eba629b634090849456774ce8.exe
-
Size
663KB
-
MD5
8231d8d9d1c38a7f2ebce20944bcfc63
-
SHA1
ca190e6cab231bd140dab3a13c7a59cb88c85e7b
-
SHA256
77058147d37749df7378249a128a5298de49787eba629b634090849456774ce8
-
SHA512
8025a7c2231a562bf4d0ff76a813585606462a51a1b76a34d54f0640b4f591d8abdc32928795162f987f6dfd42f16e10c340f27a62ad87b18cec81bdb9a68cc2
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:KZ1xuVVjfFoynPaVBUR8f+kN10Ed
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1