Analysis
-
max time kernel
7s -
max time network
69s -
platform
windows7_x64 -
resource
win7 -
submitted
06-07-2020 06:38
Static task
static1
Behavioral task
behavioral1
Sample
7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe
Resource
win7
General
-
Target
7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe
-
Size
1.5MB
-
MD5
49b156bbea23cd6434d7829ed25b051a
-
SHA1
075007dabafb065909e0d7d1cb4a1ec05724e9ec
-
SHA256
7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2
-
SHA512
19dcbb72d9c3b065587731066bc4ad50968978c1569ae7aad8680722333555926a7977762674ec8d5d98add1c06b6e265b80687528b9689940dfc5c3f4c8460b
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ichader.exepid process 1904 ichader.exe -
Processes:
resource yara_rule behavioral1/memory/1744-34-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1744-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1744-40-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exepid process 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exedescription pid process target process PID 1492 set thread context of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 set thread context of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exesvchost.exe7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exeichader.exepid process 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 1480 svchost.exe 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 1904 ichader.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.execmd.exedescription pid process target process PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1480 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe svchost.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1492 wrote to memory of 1744 1492 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe PID 1744 wrote to memory of 1880 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe cmd.exe PID 1744 wrote to memory of 1880 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe cmd.exe PID 1744 wrote to memory of 1880 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe cmd.exe PID 1744 wrote to memory of 1880 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe cmd.exe PID 1880 wrote to memory of 1888 1880 cmd.exe reg.exe PID 1880 wrote to memory of 1888 1880 cmd.exe reg.exe PID 1880 wrote to memory of 1888 1880 cmd.exe reg.exe PID 1880 wrote to memory of 1888 1880 cmd.exe reg.exe PID 1744 wrote to memory of 1904 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe ichader.exe PID 1744 wrote to memory of 1904 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe ichader.exe PID 1744 wrote to memory of 1904 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe ichader.exe PID 1744 wrote to memory of 1904 1744 7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe"C:\Users\Admin\AppData\Local\Temp\7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe"C:\Users\Admin\AppData\Local\Temp\7e5ee35cbbe65bf740654be40f4ac3c6c891073b96afb658eb1a42e4736618d2.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\MIIUR.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MIIUR.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
b785c2290f2479d8b040cd9a5b1f843b
SHA14eea4cdde8532fb28567825a86c3f161f4e6db5e
SHA2563b32b442071dfd98011e25b2a3468ca770a2681f67b7cdba4b73ad904708466f
SHA5128bc8beebe4c64dacf3145ccf33074dbecce030cef3b9e9e7d45bbda7728d223507cdb43d7acc00b229cbfe6d81e4555675409b8b3f3f885efb99873272347b75
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
b785c2290f2479d8b040cd9a5b1f843b
SHA14eea4cdde8532fb28567825a86c3f161f4e6db5e
SHA2563b32b442071dfd98011e25b2a3468ca770a2681f67b7cdba4b73ad904708466f
SHA5128bc8beebe4c64dacf3145ccf33074dbecce030cef3b9e9e7d45bbda7728d223507cdb43d7acc00b229cbfe6d81e4555675409b8b3f3f885efb99873272347b75
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
b785c2290f2479d8b040cd9a5b1f843b
SHA14eea4cdde8532fb28567825a86c3f161f4e6db5e
SHA2563b32b442071dfd98011e25b2a3468ca770a2681f67b7cdba4b73ad904708466f
SHA5128bc8beebe4c64dacf3145ccf33074dbecce030cef3b9e9e7d45bbda7728d223507cdb43d7acc00b229cbfe6d81e4555675409b8b3f3f885efb99873272347b75
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
b785c2290f2479d8b040cd9a5b1f843b
SHA14eea4cdde8532fb28567825a86c3f161f4e6db5e
SHA2563b32b442071dfd98011e25b2a3468ca770a2681f67b7cdba4b73ad904708466f
SHA5128bc8beebe4c64dacf3145ccf33074dbecce030cef3b9e9e7d45bbda7728d223507cdb43d7acc00b229cbfe6d81e4555675409b8b3f3f885efb99873272347b75
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
b785c2290f2479d8b040cd9a5b1f843b
SHA14eea4cdde8532fb28567825a86c3f161f4e6db5e
SHA2563b32b442071dfd98011e25b2a3468ca770a2681f67b7cdba4b73ad904708466f
SHA5128bc8beebe4c64dacf3145ccf33074dbecce030cef3b9e9e7d45bbda7728d223507cdb43d7acc00b229cbfe6d81e4555675409b8b3f3f885efb99873272347b75
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
b785c2290f2479d8b040cd9a5b1f843b
SHA14eea4cdde8532fb28567825a86c3f161f4e6db5e
SHA2563b32b442071dfd98011e25b2a3468ca770a2681f67b7cdba4b73ad904708466f
SHA5128bc8beebe4c64dacf3145ccf33074dbecce030cef3b9e9e7d45bbda7728d223507cdb43d7acc00b229cbfe6d81e4555675409b8b3f3f885efb99873272347b75
-
memory/1480-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1480-35-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1480-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1480-32-0x000000000040B000-mapping.dmp
-
memory/1492-26-0x00000000006B8000-0x00000000006B9000-memory.dmpFilesize
4KB
-
memory/1492-12-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-17-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-18-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-19-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-22-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-23-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-24-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-25-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-2-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-27-0x00000000006B8000-0x00000000006B9000-memory.dmpFilesize
4KB
-
memory/1492-28-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-29-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-30-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-13-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-16-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-11-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-3-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-10-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-4-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-5-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-6-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-7-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-8-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1492-9-0x00000000006B6000-0x00000000006B7000-memory.dmpFilesize
4KB
-
memory/1744-40-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1744-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1744-36-0x00000000004085D0-mapping.dmp
-
memory/1744-34-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1880-43-0x0000000000000000-mapping.dmp
-
memory/1888-45-0x0000000000000000-mapping.dmp
-
memory/1904-51-0x0000000000000000-mapping.dmp