Analysis
-
max time kernel
21s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
29-06-2020 07:16
Static task
static1
Behavioral task
behavioral1
Sample
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
Resource
win7
General
-
Target
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
-
Size
1.5MB
-
MD5
1c72f2ac3f8aedcb677d1843030402e2
-
SHA1
0b4a2c3e4c919c95c2543eaad8bb8e207fede04c
-
SHA256
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471
-
SHA512
0532968f04a30cf7e63f95d6bcbd13a8a59ea13afefd8987aba2811f22c0995adabff33773b335933ea8064aeebdb83af4168bf6f75940d8ea1130c59a6e38f4
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3516 ichader.exe 3908 ichader.exe 4008 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/1684-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1684-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1684-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4008-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4008-37-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4008-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exeichader.exedescription pid process target process PID 2804 set thread context of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 set thread context of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 3516 set thread context of 4044 3516 ichader.exe svchost.exe PID 3516 set thread context of 3908 3516 ichader.exe ichader.exe PID 3516 set thread context of 4008 3516 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 4008 ichader.exe Token: SeSecurityPrivilege 4008 ichader.exe Token: SeTakeOwnershipPrivilege 4008 ichader.exe Token: SeLoadDriverPrivilege 4008 ichader.exe Token: SeSystemProfilePrivilege 4008 ichader.exe Token: SeSystemtimePrivilege 4008 ichader.exe Token: SeProfSingleProcessPrivilege 4008 ichader.exe Token: SeIncBasePriorityPrivilege 4008 ichader.exe Token: SeCreatePagefilePrivilege 4008 ichader.exe Token: SeBackupPrivilege 4008 ichader.exe Token: SeRestorePrivilege 4008 ichader.exe Token: SeShutdownPrivilege 4008 ichader.exe Token: SeDebugPrivilege 4008 ichader.exe Token: SeSystemEnvironmentPrivilege 4008 ichader.exe Token: SeChangeNotifyPrivilege 4008 ichader.exe Token: SeRemoteShutdownPrivilege 4008 ichader.exe Token: SeUndockPrivilege 4008 ichader.exe Token: SeManageVolumePrivilege 4008 ichader.exe Token: SeImpersonatePrivilege 4008 ichader.exe Token: SeCreateGlobalPrivilege 4008 ichader.exe Token: 33 4008 ichader.exe Token: 34 4008 ichader.exe Token: 35 4008 ichader.exe Token: 36 4008 ichader.exe Token: SeDebugPrivilege 3908 ichader.exe Token: SeDebugPrivilege 3908 ichader.exe Token: SeDebugPrivilege 3908 ichader.exe Token: SeDebugPrivilege 3908 ichader.exe Token: SeDebugPrivilege 3908 ichader.exe Token: SeDebugPrivilege 3908 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exesvchost.exe861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exeichader.exesvchost.exeichader.exeichader.exepid process 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 1532 svchost.exe 1684 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 3516 ichader.exe 4044 svchost.exe 3908 ichader.exe 4008 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.execmd.exeichader.exedescription pid process target process PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1532 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 2804 wrote to memory of 1684 2804 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 1684 wrote to memory of 2188 1684 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe cmd.exe PID 1684 wrote to memory of 2188 1684 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe cmd.exe PID 1684 wrote to memory of 2188 1684 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe cmd.exe PID 2188 wrote to memory of 2784 2188 cmd.exe reg.exe PID 2188 wrote to memory of 2784 2188 cmd.exe reg.exe PID 2188 wrote to memory of 2784 2188 cmd.exe reg.exe PID 1684 wrote to memory of 3516 1684 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe ichader.exe PID 1684 wrote to memory of 3516 1684 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe ichader.exe PID 1684 wrote to memory of 3516 1684 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe ichader.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 4044 3516 ichader.exe svchost.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 3908 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe PID 3516 wrote to memory of 4008 3516 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LIIUQ.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LIIUQ.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
cf422ad3df3b60ce487c2bd08989ef46
SHA132dfdd95f9dec4b596f4447d9a600a2e396d6417
SHA256bbe09c8e7fe0b211914ee4466e0afa9c3228e8b5bca8016f594c819f711534e4
SHA5124c9675dac92307cabeeff078cdc5e30f4113172b8fdf3a3050b35edde7787857a24fb6ac437324b85de9a2968917c1ab9d4fde3cf540e65d1b9bcc7b3767daa3
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
cf422ad3df3b60ce487c2bd08989ef46
SHA132dfdd95f9dec4b596f4447d9a600a2e396d6417
SHA256bbe09c8e7fe0b211914ee4466e0afa9c3228e8b5bca8016f594c819f711534e4
SHA5124c9675dac92307cabeeff078cdc5e30f4113172b8fdf3a3050b35edde7787857a24fb6ac437324b85de9a2968917c1ab9d4fde3cf540e65d1b9bcc7b3767daa3
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
cf422ad3df3b60ce487c2bd08989ef46
SHA132dfdd95f9dec4b596f4447d9a600a2e396d6417
SHA256bbe09c8e7fe0b211914ee4466e0afa9c3228e8b5bca8016f594c819f711534e4
SHA5124c9675dac92307cabeeff078cdc5e30f4113172b8fdf3a3050b35edde7787857a24fb6ac437324b85de9a2968917c1ab9d4fde3cf540e65d1b9bcc7b3767daa3
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
cf422ad3df3b60ce487c2bd08989ef46
SHA132dfdd95f9dec4b596f4447d9a600a2e396d6417
SHA256bbe09c8e7fe0b211914ee4466e0afa9c3228e8b5bca8016f594c819f711534e4
SHA5124c9675dac92307cabeeff078cdc5e30f4113172b8fdf3a3050b35edde7787857a24fb6ac437324b85de9a2968917c1ab9d4fde3cf540e65d1b9bcc7b3767daa3
-
memory/1532-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1532-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1532-3-0x000000000040B000-mapping.dmp
-
memory/1532-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1684-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1684-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1684-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1684-8-0x00000000004085D0-mapping.dmp
-
memory/2188-14-0x0000000000000000-mapping.dmp
-
memory/2784-16-0x0000000000000000-mapping.dmp
-
memory/3516-17-0x0000000000000000-mapping.dmp
-
memory/3908-28-0x00000000004085D0-mapping.dmp
-
memory/4008-32-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4008-34-0x00000000004B5210-mapping.dmp
-
memory/4008-37-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4008-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4044-24-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4044-23-0x000000000040B000-mapping.dmp
-
memory/4044-22-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB