Analysis
-
max time kernel
3s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe
Resource
win7v20201028
General
-
Target
b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe
-
Size
1.5MB
-
MD5
175d4a702cd0982cb40ea858c2f93441
-
SHA1
703f6b9ac5e02e628473e5c2314fc4ac9adb481a
-
SHA256
b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea
-
SHA512
b55c0e7fb1911044837b2f9f0aabb41b3da5252e5fee99ffa50c8241ce93b5be98dcc05dde08519bf95adf12640df99d6c75dad7cdc96a3ba68907db03990c88
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1080-37-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-40-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1684-96-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-99-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-102-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exedescription pid process target process PID 1892 set thread context of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 set thread context of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe 344 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exesvchost.exeb3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exepid process 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe 344 svchost.exe 1080 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exedescription pid process target process PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 344 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe svchost.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe PID 1892 wrote to memory of 1080 1892 b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe"C:\Users\Admin\AppData\Local\Temp\b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:344 -
C:\Users\Admin\AppData\Local\Temp\b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe"C:\Users\Admin\AppData\Local\Temp\b3fa952967142383572df3400a9041a5f38982342cbb632f3ad0e6c7ac6105ea.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1080
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HJWWE.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
6e6613fd1b0e918db79aefffb92fa55a
SHA1b92cda6786d69be14265c352667c20aa00a4010c
SHA25683f5462b6e5b5ffee258f46dfa9383f80d1c93f7c6be007e2cd774550ddda1e1
SHA51206b638d3338eebf47b56566e121637b637d95edfcc1fcfc14d6cf0c9bb1d4ea90f2b5ddc2a7ea13d0ae3bcbe896a8279e4e7b077530ad38f30aae62b5db38563
-
memory/344-34-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/344-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/344-32-0x000000000040B000-mapping.dmp
-
memory/344-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/436-43-0x0000000000000000-mapping.dmp
-
memory/760-45-0x0000000000000000-mapping.dmp
-
memory/1080-37-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-38-0x00000000004085D0-mapping.dmp
-
memory/1080-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-40-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1556-71-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-79-0x0000000000738000-0x0000000000739000-memory.dmpFilesize
4KB
-
memory/1556-83-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-82-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-81-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-80-0x0000000000738000-0x0000000000739000-memory.dmpFilesize
4KB
-
memory/1556-78-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-77-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-76-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-75-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-72-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-70-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-69-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-66-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-65-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-64-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-63-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-62-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-61-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-60-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-59-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-51-0x0000000000000000-mapping.dmp
-
memory/1556-58-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-55-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-56-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1556-57-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1620-84-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1620-85-0x000000000040B000-mapping.dmp
-
memory/1620-86-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1684-102-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-99-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-96-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-97-0x00000000004B5210-mapping.dmp
-
memory/1844-90-0x00000000004085D0-mapping.dmp
-
memory/1892-16-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-29-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-17-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-3-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-19-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-22-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-23-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-24-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-25-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-27-0x0000000000278000-0x0000000000279000-memory.dmpFilesize
4KB
-
memory/1892-26-0x0000000000278000-0x0000000000279000-memory.dmpFilesize
4KB
-
memory/1892-30-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-28-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-18-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-5-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-6-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-13-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-12-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-4-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-11-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-10-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-9-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-2-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-8-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB
-
memory/1892-7-0x0000000000276000-0x0000000000277000-memory.dmpFilesize
4KB