Analysis
-
max time kernel
7s -
max time network
141s -
platform
windows10_x64 -
resource
win10 -
submitted
29-06-2020 07:15
Static task
static1
Behavioral task
behavioral1
Sample
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
Resource
win7
General
-
Target
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
-
Size
1.5MB
-
MD5
0a383f6b665eb5e072773c9875d459cd
-
SHA1
aed86ee444beb6eddd188cc58f6e69430c1274ed
-
SHA256
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e
-
SHA512
c93aefa7e61e379047dd967f5af0b57803b34228921037ea01893b40002ea079c7c57228b23e3770ff4c8d5c0ec175f58bd037a9f4fef8415a60308176437a9f
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3048 ichader.exe 3060 ichader.exe 3692 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3836-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3836-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3836-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3692-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3692-37-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3692-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exeichader.exedescription pid process target process PID 976 set thread context of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 set thread context of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 3048 set thread context of 3984 3048 ichader.exe svchost.exe PID 3048 set thread context of 3060 3048 ichader.exe ichader.exe PID 3048 set thread context of 3692 3048 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe 3876 svchost.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 3692 ichader.exe Token: SeSecurityPrivilege 3692 ichader.exe Token: SeTakeOwnershipPrivilege 3692 ichader.exe Token: SeLoadDriverPrivilege 3692 ichader.exe Token: SeSystemProfilePrivilege 3692 ichader.exe Token: SeSystemtimePrivilege 3692 ichader.exe Token: SeProfSingleProcessPrivilege 3692 ichader.exe Token: SeIncBasePriorityPrivilege 3692 ichader.exe Token: SeCreatePagefilePrivilege 3692 ichader.exe Token: SeBackupPrivilege 3692 ichader.exe Token: SeRestorePrivilege 3692 ichader.exe Token: SeShutdownPrivilege 3692 ichader.exe Token: SeDebugPrivilege 3692 ichader.exe Token: SeSystemEnvironmentPrivilege 3692 ichader.exe Token: SeChangeNotifyPrivilege 3692 ichader.exe Token: SeRemoteShutdownPrivilege 3692 ichader.exe Token: SeUndockPrivilege 3692 ichader.exe Token: SeManageVolumePrivilege 3692 ichader.exe Token: SeImpersonatePrivilege 3692 ichader.exe Token: SeCreateGlobalPrivilege 3692 ichader.exe Token: 33 3692 ichader.exe Token: 34 3692 ichader.exe Token: 35 3692 ichader.exe Token: 36 3692 ichader.exe Token: SeDebugPrivilege 3060 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exesvchost.exe544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exeichader.exesvchost.exeichader.exeichader.exepid process 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 3876 svchost.exe 3836 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 3048 ichader.exe 3984 svchost.exe 3060 ichader.exe 3692 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.execmd.exeichader.exedescription pid process target process PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3876 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 976 wrote to memory of 3836 976 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 3836 wrote to memory of 3992 3836 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe cmd.exe PID 3836 wrote to memory of 3992 3836 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe cmd.exe PID 3836 wrote to memory of 3992 3836 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe cmd.exe PID 3992 wrote to memory of 3840 3992 cmd.exe reg.exe PID 3992 wrote to memory of 3840 3992 cmd.exe reg.exe PID 3992 wrote to memory of 3840 3992 cmd.exe reg.exe PID 3836 wrote to memory of 3048 3836 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe ichader.exe PID 3836 wrote to memory of 3048 3836 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe ichader.exe PID 3836 wrote to memory of 3048 3836 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe ichader.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3984 3048 ichader.exe svchost.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3060 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe PID 3048 wrote to memory of 3692 3048 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YFGDM.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\YFGDM.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5998903b74125157532cdf27870bebb3
SHA13a8fe2457922fa3904aeb6a3d530132b9e812bb9
SHA2563c003b10b9ec0f60f3385e476c0b6f2c25ffb4548c78d17d967e3500858ac986
SHA512e2ca33d80804611762160dec1d6694a2ecd0d85ff3d5a065f2d68e641f5b7d9f1f36e3debf1f86c6446ccf622973eb11fa9ddbfedc63f74e83ad64ba5245ff01
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5998903b74125157532cdf27870bebb3
SHA13a8fe2457922fa3904aeb6a3d530132b9e812bb9
SHA2563c003b10b9ec0f60f3385e476c0b6f2c25ffb4548c78d17d967e3500858ac986
SHA512e2ca33d80804611762160dec1d6694a2ecd0d85ff3d5a065f2d68e641f5b7d9f1f36e3debf1f86c6446ccf622973eb11fa9ddbfedc63f74e83ad64ba5245ff01
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5998903b74125157532cdf27870bebb3
SHA13a8fe2457922fa3904aeb6a3d530132b9e812bb9
SHA2563c003b10b9ec0f60f3385e476c0b6f2c25ffb4548c78d17d967e3500858ac986
SHA512e2ca33d80804611762160dec1d6694a2ecd0d85ff3d5a065f2d68e641f5b7d9f1f36e3debf1f86c6446ccf622973eb11fa9ddbfedc63f74e83ad64ba5245ff01
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5998903b74125157532cdf27870bebb3
SHA13a8fe2457922fa3904aeb6a3d530132b9e812bb9
SHA2563c003b10b9ec0f60f3385e476c0b6f2c25ffb4548c78d17d967e3500858ac986
SHA512e2ca33d80804611762160dec1d6694a2ecd0d85ff3d5a065f2d68e641f5b7d9f1f36e3debf1f86c6446ccf622973eb11fa9ddbfedc63f74e83ad64ba5245ff01
-
memory/3048-17-0x0000000000000000-mapping.dmp
-
memory/3060-29-0x00000000004085D0-mapping.dmp
-
memory/3692-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3692-37-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3692-34-0x00000000004B5210-mapping.dmp
-
memory/3692-32-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3836-8-0x00000000004085D0-mapping.dmp
-
memory/3836-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3836-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3836-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3840-16-0x0000000000000000-mapping.dmp
-
memory/3876-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3876-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3876-3-0x000000000040B000-mapping.dmp
-
memory/3876-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3984-24-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3984-23-0x000000000040B000-mapping.dmp
-
memory/3984-22-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3992-14-0x0000000000000000-mapping.dmp