General
-
Target
44f322e2854efab6ac9b1fa2eca905693a0e30c47a868d40f9000bdfca190492.exe
-
Size
911KB
-
Sample
241206-mleqcsypbr
-
MD5
364b4bd7eaa2e18cd24131ee65f640d5
-
SHA1
f9c03666182cf01b87495085caf3891b5c0bd43c
-
SHA256
44f322e2854efab6ac9b1fa2eca905693a0e30c47a868d40f9000bdfca190492
-
SHA512
c19d9b65ebd1cce8fab62def44647d84827e23fbcb55a04fc0ba9bb53e368751a92c81217b366b4a472e4b9f3aa3e3c658db800cbd145c14ac8a8257c2c68689
-
SSDEEP
24576:sCUKoN0bUxgGa/pfBHDb+y1HgZfUD0QZh9ug:sNK1A6CHg
Behavioral task
behavioral1
Sample
44f322e2854efab6ac9b1fa2eca905693a0e30c47a868d40f9000bdfca190492.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
44f322e2854efab6ac9b1fa2eca905693a0e30c47a868d40f9000bdfca190492.exe
-
Size
911KB
-
MD5
364b4bd7eaa2e18cd24131ee65f640d5
-
SHA1
f9c03666182cf01b87495085caf3891b5c0bd43c
-
SHA256
44f322e2854efab6ac9b1fa2eca905693a0e30c47a868d40f9000bdfca190492
-
SHA512
c19d9b65ebd1cce8fab62def44647d84827e23fbcb55a04fc0ba9bb53e368751a92c81217b366b4a472e4b9f3aa3e3c658db800cbd145c14ac8a8257c2c68689
-
SSDEEP
24576:sCUKoN0bUxgGa/pfBHDb+y1HgZfUD0QZh9ug:sNK1A6CHg
-
Darkcomet family
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7