Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    00f75c9a655082b09bb74fba7c2df1e8f399ec3dd3a1d077090ee0c38d2c1554N.exe

  • Size

    527KB

  • Sample

    250111-gszffsxqax

  • MD5

    c88959978013b577c7ad729571465050

  • SHA1

    d2f90686d9044e57e0294608289ec63a02a132a5

  • SHA256

    00f75c9a655082b09bb74fba7c2df1e8f399ec3dd3a1d077090ee0c38d2c1554

  • SHA512

    eff7b78e5a326ae7d46177c2f7c8bbd85c5be700c5adac80eaea25b5d0cb59af081f0cf31dcb421cdac76cff9a7718bccb13d90d5d420e8618d8a96cae8befa5

  • SSDEEP

    12288:UXqKvamE4Yy2/Mv6m216SEXWTSPJOhKz0rvcKAqYlr:UaAI3onm2JKULYYB

Malware Config

Extracted

Family

darkcomet

Botnet

WinUC

C2

karinwebcam.no-ip.biz:1004

Mutex

DC_MUTEX-7TG741T

Attributes
  • InstallPath

    explorer\explorer.exe

  • gencode

    ppWkXTKeUVQg

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    Explorer

Targets

    • Target

      00f75c9a655082b09bb74fba7c2df1e8f399ec3dd3a1d077090ee0c38d2c1554N.exe

    • Size

      527KB

    • MD5

      c88959978013b577c7ad729571465050

    • SHA1

      d2f90686d9044e57e0294608289ec63a02a132a5

    • SHA256

      00f75c9a655082b09bb74fba7c2df1e8f399ec3dd3a1d077090ee0c38d2c1554

    • SHA512

      eff7b78e5a326ae7d46177c2f7c8bbd85c5be700c5adac80eaea25b5d0cb59af081f0cf31dcb421cdac76cff9a7718bccb13d90d5d420e8618d8a96cae8befa5

    • SSDEEP

      12288:UXqKvamE4Yy2/Mv6m216SEXWTSPJOhKz0rvcKAqYlr:UaAI3onm2JKULYYB

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks