Analysis
-
max time kernel
10s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
29-06-2020 07:16
Static task
static1
Behavioral task
behavioral1
Sample
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
Resource
win7
General
-
Target
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
-
Size
1.5MB
-
MD5
024031a11521b17f29263c4da1e3b575
-
SHA1
5889feced3e587271f4943ac487067734c9c8d93
-
SHA256
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6
-
SHA512
04edd2e7e3565d1f8dbe9394bf7f4cb5010a1e9845a5068addb62dfce9b07d65f4e5f45361c4d88172067eb48871501d6881688c13148581474f7a185a80d3b6
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 724 ichader.exe 2168 ichader.exe 3112 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/4024-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4024-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4024-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3112-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3112-36-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3112-38-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exeichader.exedescription pid process target process PID 3888 set thread context of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 set thread context of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 724 set thread context of 3368 724 ichader.exe svchost.exe PID 724 set thread context of 2168 724 ichader.exe ichader.exe PID 724 set thread context of 3112 724 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe 3924 svchost.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 3112 ichader.exe Token: SeSecurityPrivilege 3112 ichader.exe Token: SeTakeOwnershipPrivilege 3112 ichader.exe Token: SeLoadDriverPrivilege 3112 ichader.exe Token: SeSystemProfilePrivilege 3112 ichader.exe Token: SeSystemtimePrivilege 3112 ichader.exe Token: SeProfSingleProcessPrivilege 3112 ichader.exe Token: SeIncBasePriorityPrivilege 3112 ichader.exe Token: SeCreatePagefilePrivilege 3112 ichader.exe Token: SeBackupPrivilege 3112 ichader.exe Token: SeRestorePrivilege 3112 ichader.exe Token: SeShutdownPrivilege 3112 ichader.exe Token: SeDebugPrivilege 3112 ichader.exe Token: SeSystemEnvironmentPrivilege 3112 ichader.exe Token: SeChangeNotifyPrivilege 3112 ichader.exe Token: SeRemoteShutdownPrivilege 3112 ichader.exe Token: SeUndockPrivilege 3112 ichader.exe Token: SeManageVolumePrivilege 3112 ichader.exe Token: SeImpersonatePrivilege 3112 ichader.exe Token: SeCreateGlobalPrivilege 3112 ichader.exe Token: 33 3112 ichader.exe Token: 34 3112 ichader.exe Token: 35 3112 ichader.exe Token: 36 3112 ichader.exe Token: SeDebugPrivilege 2168 ichader.exe Token: SeDebugPrivilege 2168 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exesvchost.exea19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exeichader.exesvchost.exeichader.exeichader.exepid process 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe 3924 svchost.exe 4024 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe 724 ichader.exe 3368 svchost.exe 2168 ichader.exe 3112 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exea19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.execmd.exeichader.exedescription pid process target process PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 3924 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 3888 wrote to memory of 4024 3888 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 4024 wrote to memory of 3972 4024 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe cmd.exe PID 4024 wrote to memory of 3972 4024 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe cmd.exe PID 4024 wrote to memory of 3972 4024 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe cmd.exe PID 3972 wrote to memory of 3436 3972 cmd.exe reg.exe PID 3972 wrote to memory of 3436 3972 cmd.exe reg.exe PID 3972 wrote to memory of 3436 3972 cmd.exe reg.exe PID 4024 wrote to memory of 724 4024 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe ichader.exe PID 4024 wrote to memory of 724 4024 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe ichader.exe PID 4024 wrote to memory of 724 4024 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe ichader.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 3368 724 ichader.exe svchost.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 2168 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe PID 724 wrote to memory of 3112 724 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DOTMC.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DOTMC.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0e5f06cec6ff0ead622334e2992697f0
SHA11341d26c0d93f9681655cbf52e52f4cabe3110a9
SHA25687659a97935f15413dc0bd7eb8f2332d6e7d44a46f73f2a073b86bbbf5c46f24
SHA512396e5bb2beaf1d80c8624732afb0bf03e9abf23f7f340ec49307fba7d2ecd395d4237cc93c471fbdb1a5e7c065e9b1f36b484546161896e211a9fa2b4a07de40
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0e5f06cec6ff0ead622334e2992697f0
SHA11341d26c0d93f9681655cbf52e52f4cabe3110a9
SHA25687659a97935f15413dc0bd7eb8f2332d6e7d44a46f73f2a073b86bbbf5c46f24
SHA512396e5bb2beaf1d80c8624732afb0bf03e9abf23f7f340ec49307fba7d2ecd395d4237cc93c471fbdb1a5e7c065e9b1f36b484546161896e211a9fa2b4a07de40
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0e5f06cec6ff0ead622334e2992697f0
SHA11341d26c0d93f9681655cbf52e52f4cabe3110a9
SHA25687659a97935f15413dc0bd7eb8f2332d6e7d44a46f73f2a073b86bbbf5c46f24
SHA512396e5bb2beaf1d80c8624732afb0bf03e9abf23f7f340ec49307fba7d2ecd395d4237cc93c471fbdb1a5e7c065e9b1f36b484546161896e211a9fa2b4a07de40
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0e5f06cec6ff0ead622334e2992697f0
SHA11341d26c0d93f9681655cbf52e52f4cabe3110a9
SHA25687659a97935f15413dc0bd7eb8f2332d6e7d44a46f73f2a073b86bbbf5c46f24
SHA512396e5bb2beaf1d80c8624732afb0bf03e9abf23f7f340ec49307fba7d2ecd395d4237cc93c471fbdb1a5e7c065e9b1f36b484546161896e211a9fa2b4a07de40
-
memory/724-17-0x0000000000000000-mapping.dmp
-
memory/2168-29-0x00000000004085D0-mapping.dmp
-
memory/3112-38-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3112-36-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3112-34-0x00000000004B5210-mapping.dmp
-
memory/3112-32-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3368-22-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3368-23-0x000000000040B000-mapping.dmp
-
memory/3368-24-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3436-16-0x0000000000000000-mapping.dmp
-
memory/3924-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3924-3-0x000000000040B000-mapping.dmp
-
memory/3924-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3924-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3972-14-0x0000000000000000-mapping.dmp
-
memory/4024-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4024-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4024-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4024-8-0x00000000004085D0-mapping.dmp