Analysis
-
max time kernel
8s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:50
Static task
static1
Behavioral task
behavioral1
Sample
fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe
Resource
win7v20201028
General
-
Target
fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe
-
Size
1.5MB
-
MD5
f82031ee1e40e4341bfde851b1cb4c4f
-
SHA1
916547b801d7b930cf98f8ad723aee5384e32623
-
SHA256
fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6
-
SHA512
57ec4eed21adf2564ec617766b045a97d5d8797bb97525c20239f15344327f7f07970903c6dbde2679e962efa1ed91137a714a76023c0999979dc1b9254aaaac
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3348 ichader.exe 3304 ichader.exe 1940 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3156-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3156-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3156-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1940-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1940-40-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1940-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exeichader.exedescription pid process target process PID 672 set thread context of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 set thread context of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 3348 set thread context of 3660 3348 ichader.exe svchost.exe PID 3348 set thread context of 3304 3348 ichader.exe ichader.exe PID 3348 set thread context of 1940 3348 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 1940 ichader.exe Token: SeSecurityPrivilege 1940 ichader.exe Token: SeTakeOwnershipPrivilege 1940 ichader.exe Token: SeLoadDriverPrivilege 1940 ichader.exe Token: SeSystemProfilePrivilege 1940 ichader.exe Token: SeSystemtimePrivilege 1940 ichader.exe Token: SeProfSingleProcessPrivilege 1940 ichader.exe Token: SeIncBasePriorityPrivilege 1940 ichader.exe Token: SeCreatePagefilePrivilege 1940 ichader.exe Token: SeBackupPrivilege 1940 ichader.exe Token: SeRestorePrivilege 1940 ichader.exe Token: SeShutdownPrivilege 1940 ichader.exe Token: SeDebugPrivilege 1940 ichader.exe Token: SeSystemEnvironmentPrivilege 1940 ichader.exe Token: SeChangeNotifyPrivilege 1940 ichader.exe Token: SeRemoteShutdownPrivilege 1940 ichader.exe Token: SeUndockPrivilege 1940 ichader.exe Token: SeManageVolumePrivilege 1940 ichader.exe Token: SeImpersonatePrivilege 1940 ichader.exe Token: SeCreateGlobalPrivilege 1940 ichader.exe Token: 33 1940 ichader.exe Token: 34 1940 ichader.exe Token: 35 1940 ichader.exe Token: 36 1940 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exesvchost.exefddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exeichader.exesvchost.exeichader.exeichader.exepid process 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe 3752 svchost.exe 3156 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe 3348 ichader.exe 3660 svchost.exe 3304 ichader.exe 1940 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exefddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.execmd.exeichader.exedescription pid process target process PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3752 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe svchost.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 672 wrote to memory of 3156 672 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe PID 3156 wrote to memory of 184 3156 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe cmd.exe PID 3156 wrote to memory of 184 3156 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe cmd.exe PID 3156 wrote to memory of 184 3156 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe cmd.exe PID 184 wrote to memory of 2720 184 cmd.exe reg.exe PID 184 wrote to memory of 2720 184 cmd.exe reg.exe PID 184 wrote to memory of 2720 184 cmd.exe reg.exe PID 3156 wrote to memory of 3348 3156 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe ichader.exe PID 3156 wrote to memory of 3348 3156 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe ichader.exe PID 3156 wrote to memory of 3348 3156 fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe ichader.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3660 3348 ichader.exe svchost.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 3304 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe PID 3348 wrote to memory of 1940 3348 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe"C:\Users\Admin\AppData\Local\Temp\fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe"C:\Users\Admin\AppData\Local\Temp\fddb7d6120715aad3f0661513fd2c868b14a71b25009de9c8cbeefc1fa36abc6.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DNTLB.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DNTLB.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9ff86fc62decb1b6398362826c339812
SHA1e0940e22fd66755672d971baa4598cfccb892497
SHA2560450af2f67235251ada103eac35a1824ccdbd3f4a8140c432789e7a7eeb59747
SHA51294f4f8a3ea17895a67c43c645fbae8fa657430a6728e25373d7321b9a62977ba3a68edebaee11fb528f6331d7d8b98fffe80e0197d413a40e357511d6f11a936
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9ff86fc62decb1b6398362826c339812
SHA1e0940e22fd66755672d971baa4598cfccb892497
SHA2560450af2f67235251ada103eac35a1824ccdbd3f4a8140c432789e7a7eeb59747
SHA51294f4f8a3ea17895a67c43c645fbae8fa657430a6728e25373d7321b9a62977ba3a68edebaee11fb528f6331d7d8b98fffe80e0197d413a40e357511d6f11a936
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9ff86fc62decb1b6398362826c339812
SHA1e0940e22fd66755672d971baa4598cfccb892497
SHA2560450af2f67235251ada103eac35a1824ccdbd3f4a8140c432789e7a7eeb59747
SHA51294f4f8a3ea17895a67c43c645fbae8fa657430a6728e25373d7321b9a62977ba3a68edebaee11fb528f6331d7d8b98fffe80e0197d413a40e357511d6f11a936
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9ff86fc62decb1b6398362826c339812
SHA1e0940e22fd66755672d971baa4598cfccb892497
SHA2560450af2f67235251ada103eac35a1824ccdbd3f4a8140c432789e7a7eeb59747
SHA51294f4f8a3ea17895a67c43c645fbae8fa657430a6728e25373d7321b9a62977ba3a68edebaee11fb528f6331d7d8b98fffe80e0197d413a40e357511d6f11a936
-
memory/184-14-0x0000000000000000-mapping.dmp
-
memory/1940-34-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1940-38-0x0000000073B00000-0x0000000073B93000-memory.dmpFilesize
588KB
-
memory/1940-40-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1940-36-0x00000000004B5210-mapping.dmp
-
memory/1940-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2720-16-0x0000000000000000-mapping.dmp
-
memory/3156-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3156-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3156-9-0x00000000004085D0-mapping.dmp
-
memory/3156-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3304-29-0x00000000004085D0-mapping.dmp
-
memory/3304-32-0x0000000073B00000-0x0000000073B93000-memory.dmpFilesize
588KB
-
memory/3348-17-0x0000000000000000-mapping.dmp
-
memory/3348-20-0x0000000073B00000-0x0000000073B93000-memory.dmpFilesize
588KB
-
memory/3660-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3660-24-0x000000000040B000-mapping.dmp
-
memory/3660-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3752-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3752-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3752-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3752-3-0x000000000040B000-mapping.dmp