General
-
Target
test.exe
-
Size
658KB
-
Sample
240801-vqq8ys1ajp
-
MD5
ec24d90ed3c9befd6c389eef8a7b30d0
-
SHA1
fd5ced24ad422b5f3d63b90b99384b7b7dbb4792
-
SHA256
655eea77b66bbaa7012c3f84d6d6e81c4348146ea0736db0b329a2a9c1a9ada6
-
SHA512
0652aabb75f7cf146d58e22a2dc0d6c8db0ef360776edf52282dad7389c3efb908c39e14f2d4ece4480e481f5cc19123fac5479f0e3e587df9471ec0214892dd
-
SSDEEP
12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hq:qZ1xuVVjfFoynPaVBUR8f+kN10EBk
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
test.exe
Resource
win10-20240404-en
Malware Config
Extracted
darkcomet
Guest16
insurance-helmet.gl.at.ply.gg:31388
DC_MUTEX-LP7CXKP
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
AmrqVD7MwH6g
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
test.exe
-
Size
658KB
-
MD5
ec24d90ed3c9befd6c389eef8a7b30d0
-
SHA1
fd5ced24ad422b5f3d63b90b99384b7b7dbb4792
-
SHA256
655eea77b66bbaa7012c3f84d6d6e81c4348146ea0736db0b329a2a9c1a9ada6
-
SHA512
0652aabb75f7cf146d58e22a2dc0d6c8db0ef360776edf52282dad7389c3efb908c39e14f2d4ece4480e481f5cc19123fac5479f0e3e587df9471ec0214892dd
-
SSDEEP
12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hq:qZ1xuVVjfFoynPaVBUR8f+kN10EBk
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
8