Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe
Resource
win7v20201028
General
-
Target
d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe
-
Size
1.5MB
-
MD5
2060cf6432b646182580e06af0a94b86
-
SHA1
971ae2293c426fbd7ed0808e7ba5de2c2f461cde
-
SHA256
d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590
-
SHA512
d063087f676452574a6e9e989fc8227fe8ec1ddac3da991802e16fb730b5fae174b92be04aba9a92d56ffb1449093097570a9d451a8c105bfd4360b9b89372a8
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 516 ichader.exe 1176 ichader.exe 1344 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3708-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3708-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3708-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1344-31-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1344-37-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1344-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exeichader.exedescription pid process target process PID 4632 set thread context of 3520 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe svchost.exe PID 4632 set thread context of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 516 set thread context of 1044 516 ichader.exe svchost.exe PID 516 set thread context of 1176 516 ichader.exe ichader.exe PID 516 set thread context of 1344 516 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3628 3520 WerFault.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 1344 ichader.exe Token: SeSecurityPrivilege 1344 ichader.exe Token: SeTakeOwnershipPrivilege 1344 ichader.exe Token: SeLoadDriverPrivilege 1344 ichader.exe Token: SeSystemProfilePrivilege 1344 ichader.exe Token: SeSystemtimePrivilege 1344 ichader.exe Token: SeProfSingleProcessPrivilege 1344 ichader.exe Token: SeIncBasePriorityPrivilege 1344 ichader.exe Token: SeCreatePagefilePrivilege 1344 ichader.exe Token: SeBackupPrivilege 1344 ichader.exe Token: SeRestorePrivilege 1344 ichader.exe Token: SeShutdownPrivilege 1344 ichader.exe Token: SeDebugPrivilege 1344 ichader.exe Token: SeSystemEnvironmentPrivilege 1344 ichader.exe Token: SeChangeNotifyPrivilege 1344 ichader.exe Token: SeRemoteShutdownPrivilege 1344 ichader.exe Token: SeUndockPrivilege 1344 ichader.exe Token: SeManageVolumePrivilege 1344 ichader.exe Token: SeImpersonatePrivilege 1344 ichader.exe Token: SeCreateGlobalPrivilege 1344 ichader.exe Token: 33 1344 ichader.exe Token: 34 1344 ichader.exe Token: 35 1344 ichader.exe Token: 36 1344 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe Token: SeDebugPrivilege 1176 ichader.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exed2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exeichader.exesvchost.exeichader.exeichader.exepid process 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe 3708 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe 516 ichader.exe 1044 svchost.exe 1176 ichader.exe 1344 ichader.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exed2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.execmd.exeichader.exedescription pid process target process PID 4632 wrote to memory of 3520 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe svchost.exe PID 4632 wrote to memory of 3520 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe svchost.exe PID 4632 wrote to memory of 3520 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe svchost.exe PID 4632 wrote to memory of 3520 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe svchost.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 4632 wrote to memory of 3708 4632 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe PID 3708 wrote to memory of 2808 3708 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe cmd.exe PID 3708 wrote to memory of 2808 3708 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe cmd.exe PID 3708 wrote to memory of 2808 3708 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe cmd.exe PID 2808 wrote to memory of 3168 2808 cmd.exe reg.exe PID 2808 wrote to memory of 3168 2808 cmd.exe reg.exe PID 2808 wrote to memory of 3168 2808 cmd.exe reg.exe PID 3708 wrote to memory of 516 3708 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe ichader.exe PID 3708 wrote to memory of 516 3708 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe ichader.exe PID 3708 wrote to memory of 516 3708 d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe ichader.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1044 516 ichader.exe svchost.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1176 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe PID 516 wrote to memory of 1344 516 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe"C:\Users\Admin\AppData\Local\Temp\d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 923⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe"C:\Users\Admin\AppData\Local\Temp\d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SPDPA.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SPDPA.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2060cf6432b646182580e06af0a94b86
SHA1971ae2293c426fbd7ed0808e7ba5de2c2f461cde
SHA256d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590
SHA512d063087f676452574a6e9e989fc8227fe8ec1ddac3da991802e16fb730b5fae174b92be04aba9a92d56ffb1449093097570a9d451a8c105bfd4360b9b89372a8
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2060cf6432b646182580e06af0a94b86
SHA1971ae2293c426fbd7ed0808e7ba5de2c2f461cde
SHA256d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590
SHA512d063087f676452574a6e9e989fc8227fe8ec1ddac3da991802e16fb730b5fae174b92be04aba9a92d56ffb1449093097570a9d451a8c105bfd4360b9b89372a8
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2060cf6432b646182580e06af0a94b86
SHA1971ae2293c426fbd7ed0808e7ba5de2c2f461cde
SHA256d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590
SHA512d063087f676452574a6e9e989fc8227fe8ec1ddac3da991802e16fb730b5fae174b92be04aba9a92d56ffb1449093097570a9d451a8c105bfd4360b9b89372a8
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2060cf6432b646182580e06af0a94b86
SHA1971ae2293c426fbd7ed0808e7ba5de2c2f461cde
SHA256d2bbd75bfc9a75f864ffcae530f8a791cd24a06208765190ae674a6038c05590
SHA512d063087f676452574a6e9e989fc8227fe8ec1ddac3da991802e16fb730b5fae174b92be04aba9a92d56ffb1449093097570a9d451a8c105bfd4360b9b89372a8
-
memory/516-17-0x00000000738F0000-0x0000000073983000-memory.dmpFilesize
588KB
-
memory/516-14-0x0000000000000000-mapping.dmp
-
memory/1044-22-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1044-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1044-21-0x000000000040B000-mapping.dmp
-
memory/1044-20-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1176-29-0x00000000738F0000-0x0000000073983000-memory.dmpFilesize
588KB
-
memory/1176-27-0x00000000004085D0-mapping.dmp
-
memory/1344-31-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1344-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1344-37-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1344-35-0x00000000738F0000-0x0000000073983000-memory.dmpFilesize
588KB
-
memory/1344-33-0x00000000004B5210-mapping.dmp
-
memory/2808-11-0x0000000000000000-mapping.dmp
-
memory/3168-13-0x0000000000000000-mapping.dmp
-
memory/3520-3-0x000000000040B000-mapping.dmp
-
memory/3628-9-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/3708-5-0x00000000004085D0-mapping.dmp
-
memory/3708-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3708-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3708-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB