Analysis
-
max time kernel
7s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
29-06-2020 07:12
Static task
static1
Behavioral task
behavioral1
Sample
6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe
Resource
win7
General
-
Target
6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe
-
Size
1.5MB
-
MD5
1be3d0d05edc748151b1d268312c0664
-
SHA1
4eaaa1c9177060a4333f6aa8fa13cf64f3f92dc9
-
SHA256
6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2
-
SHA512
0d33c0d7e0c52a7ea997ede1f6b1483ac52782fdba99993fb8356fa11cd405ace6414a81e11279a72f4633b09003632d7fdfdab5f965a9e2e6f871cf3c65f96f
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3716 ichader.exe 3780 ichader.exe 2272 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3928-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3928-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3928-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2272-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2272-36-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2272-38-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exeichader.exedescription pid process target process PID 3404 set thread context of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 set thread context of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3716 set thread context of 3064 3716 ichader.exe svchost.exe PID 3716 set thread context of 3780 3716 ichader.exe ichader.exe PID 3716 set thread context of 2272 3716 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe 3436 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 2272 ichader.exe Token: SeSecurityPrivilege 2272 ichader.exe Token: SeTakeOwnershipPrivilege 2272 ichader.exe Token: SeLoadDriverPrivilege 2272 ichader.exe Token: SeSystemProfilePrivilege 2272 ichader.exe Token: SeSystemtimePrivilege 2272 ichader.exe Token: SeProfSingleProcessPrivilege 2272 ichader.exe Token: SeIncBasePriorityPrivilege 2272 ichader.exe Token: SeCreatePagefilePrivilege 2272 ichader.exe Token: SeBackupPrivilege 2272 ichader.exe Token: SeRestorePrivilege 2272 ichader.exe Token: SeShutdownPrivilege 2272 ichader.exe Token: SeDebugPrivilege 2272 ichader.exe Token: SeSystemEnvironmentPrivilege 2272 ichader.exe Token: SeChangeNotifyPrivilege 2272 ichader.exe Token: SeRemoteShutdownPrivilege 2272 ichader.exe Token: SeUndockPrivilege 2272 ichader.exe Token: SeManageVolumePrivilege 2272 ichader.exe Token: SeImpersonatePrivilege 2272 ichader.exe Token: SeCreateGlobalPrivilege 2272 ichader.exe Token: 33 2272 ichader.exe Token: 34 2272 ichader.exe Token: 35 2272 ichader.exe Token: 36 2272 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exesvchost.exe6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exeichader.exesvchost.exeichader.exeichader.exepid process 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 3436 svchost.exe 3928 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 3716 ichader.exe 3064 svchost.exe 3780 ichader.exe 2272 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.execmd.exeichader.exedescription pid process target process PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3436 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe svchost.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3404 wrote to memory of 3928 3404 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe PID 3928 wrote to memory of 3432 3928 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe cmd.exe PID 3928 wrote to memory of 3432 3928 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe cmd.exe PID 3928 wrote to memory of 3432 3928 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe cmd.exe PID 3432 wrote to memory of 732 3432 cmd.exe reg.exe PID 3432 wrote to memory of 732 3432 cmd.exe reg.exe PID 3432 wrote to memory of 732 3432 cmd.exe reg.exe PID 3928 wrote to memory of 3716 3928 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe ichader.exe PID 3928 wrote to memory of 3716 3928 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe ichader.exe PID 3928 wrote to memory of 3716 3928 6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe ichader.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3064 3716 ichader.exe svchost.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 3780 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe PID 3716 wrote to memory of 2272 3716 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe"C:\Users\Admin\AppData\Local\Temp\6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe"C:\Users\Admin\AppData\Local\Temp\6f5b4bd346626b5a80aa953eaf70e095a4f332e272abddb679536f450cbdccf2.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ARIHR.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:732 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:3064 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3780 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2272
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ARIHR.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
808be73de9b453300c8684bab3c7c0a4
SHA154651f625f0b77a804f10aad12c44516395067eb
SHA256e003b88db75299894d22120c6b7bd38dd49659b9224165f64d4cf085ac7e6596
SHA512d28e9c6d033afb7dd434b2fa275222ac801a8be57a798f84f1691a2d9114b79ae8bb2fc351b8ff5183e088726ec9fe740eafaa8295bf8c4ee9d880c73829b4c3
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
808be73de9b453300c8684bab3c7c0a4
SHA154651f625f0b77a804f10aad12c44516395067eb
SHA256e003b88db75299894d22120c6b7bd38dd49659b9224165f64d4cf085ac7e6596
SHA512d28e9c6d033afb7dd434b2fa275222ac801a8be57a798f84f1691a2d9114b79ae8bb2fc351b8ff5183e088726ec9fe740eafaa8295bf8c4ee9d880c73829b4c3
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
808be73de9b453300c8684bab3c7c0a4
SHA154651f625f0b77a804f10aad12c44516395067eb
SHA256e003b88db75299894d22120c6b7bd38dd49659b9224165f64d4cf085ac7e6596
SHA512d28e9c6d033afb7dd434b2fa275222ac801a8be57a798f84f1691a2d9114b79ae8bb2fc351b8ff5183e088726ec9fe740eafaa8295bf8c4ee9d880c73829b4c3
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
808be73de9b453300c8684bab3c7c0a4
SHA154651f625f0b77a804f10aad12c44516395067eb
SHA256e003b88db75299894d22120c6b7bd38dd49659b9224165f64d4cf085ac7e6596
SHA512d28e9c6d033afb7dd434b2fa275222ac801a8be57a798f84f1691a2d9114b79ae8bb2fc351b8ff5183e088726ec9fe740eafaa8295bf8c4ee9d880c73829b4c3
-
memory/732-16-0x0000000000000000-mapping.dmp
-
memory/2272-38-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2272-36-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2272-34-0x00000000004B5210-mapping.dmp
-
memory/2272-32-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3064-22-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3064-23-0x000000000040B000-mapping.dmp
-
memory/3064-24-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3432-14-0x0000000000000000-mapping.dmp
-
memory/3436-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3436-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3436-3-0x000000000040B000-mapping.dmp
-
memory/3436-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3716-17-0x0000000000000000-mapping.dmp
-
memory/3780-28-0x00000000004085D0-mapping.dmp
-
memory/3928-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3928-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3928-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3928-9-0x00000000004085D0-mapping.dmp