Analysis
-
max time kernel
10s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe
Resource
win7v20201028
General
-
Target
05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe
-
Size
1.5MB
-
MD5
7850f2d801d0b3098635ac4fb5c13f44
-
SHA1
d3fceea6dbfff15d1b56e0b4f50c2f09d6768d28
-
SHA256
05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb
-
SHA512
5347b22ce57359fac0a7ccee84407403467120e5f2158cc236798617651ea5e3f8bc9c564391de47022f9e96626d89ff172b295a0614c11351926c2c8267de1b
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3512 ichader.exe 3408 ichader.exe 3856 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/2448-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2448-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2448-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3856-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3856-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exeichader.exedescription pid process target process PID 3928 set thread context of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 set thread context of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3512 set thread context of 1012 3512 ichader.exe svchost.exe PID 3512 set thread context of 3408 3512 ichader.exe ichader.exe PID 3512 set thread context of 3856 3512 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 3856 ichader.exe Token: SeSecurityPrivilege 3856 ichader.exe Token: SeTakeOwnershipPrivilege 3856 ichader.exe Token: SeLoadDriverPrivilege 3856 ichader.exe Token: SeSystemProfilePrivilege 3856 ichader.exe Token: SeSystemtimePrivilege 3856 ichader.exe Token: SeProfSingleProcessPrivilege 3856 ichader.exe Token: SeIncBasePriorityPrivilege 3856 ichader.exe Token: SeCreatePagefilePrivilege 3856 ichader.exe Token: SeBackupPrivilege 3856 ichader.exe Token: SeRestorePrivilege 3856 ichader.exe Token: SeShutdownPrivilege 3856 ichader.exe Token: SeDebugPrivilege 3856 ichader.exe Token: SeSystemEnvironmentPrivilege 3856 ichader.exe Token: SeChangeNotifyPrivilege 3856 ichader.exe Token: SeRemoteShutdownPrivilege 3856 ichader.exe Token: SeUndockPrivilege 3856 ichader.exe Token: SeManageVolumePrivilege 3856 ichader.exe Token: SeImpersonatePrivilege 3856 ichader.exe Token: SeCreateGlobalPrivilege 3856 ichader.exe Token: 33 3856 ichader.exe Token: 34 3856 ichader.exe Token: 35 3856 ichader.exe Token: 36 3856 ichader.exe Token: SeDebugPrivilege 3408 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exesvchost.exe05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exeichader.exesvchost.exeichader.exeichader.exepid process 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 2328 svchost.exe 2448 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 3512 ichader.exe 1012 svchost.exe 3408 ichader.exe 3856 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.execmd.exeichader.exedescription pid process target process PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2328 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe svchost.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 3928 wrote to memory of 2448 3928 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe PID 2448 wrote to memory of 4092 2448 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe cmd.exe PID 2448 wrote to memory of 4092 2448 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe cmd.exe PID 2448 wrote to memory of 4092 2448 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe cmd.exe PID 4092 wrote to memory of 748 4092 cmd.exe reg.exe PID 4092 wrote to memory of 748 4092 cmd.exe reg.exe PID 4092 wrote to memory of 748 4092 cmd.exe reg.exe PID 2448 wrote to memory of 3512 2448 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe ichader.exe PID 2448 wrote to memory of 3512 2448 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe ichader.exe PID 2448 wrote to memory of 3512 2448 05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe ichader.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 1012 3512 ichader.exe svchost.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3408 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe PID 3512 wrote to memory of 3856 3512 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe"C:\Users\Admin\AppData\Local\Temp\05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe"C:\Users\Admin\AppData\Local\Temp\05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ETURA.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:748 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:1012 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3408 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ETURA.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5cef5a3cfdb51f4a5702ce06fa8a8323
SHA16abe133b0ec46c1f1d9780e5e04c149fb3273fa5
SHA25624efb0561233fa56367f1d229660a8f756e83e875e1836de1f75e74a199a6653
SHA512ce4fe63ea62908b0fc39c08c2629475606921b4b9aba2731f1f7b2066161d2c8f7d705e68a26954749447d2dac75d7b1da075b9c88d129909eb5bf2f9de7db52
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5cef5a3cfdb51f4a5702ce06fa8a8323
SHA16abe133b0ec46c1f1d9780e5e04c149fb3273fa5
SHA25624efb0561233fa56367f1d229660a8f756e83e875e1836de1f75e74a199a6653
SHA512ce4fe63ea62908b0fc39c08c2629475606921b4b9aba2731f1f7b2066161d2c8f7d705e68a26954749447d2dac75d7b1da075b9c88d129909eb5bf2f9de7db52
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5cef5a3cfdb51f4a5702ce06fa8a8323
SHA16abe133b0ec46c1f1d9780e5e04c149fb3273fa5
SHA25624efb0561233fa56367f1d229660a8f756e83e875e1836de1f75e74a199a6653
SHA512ce4fe63ea62908b0fc39c08c2629475606921b4b9aba2731f1f7b2066161d2c8f7d705e68a26954749447d2dac75d7b1da075b9c88d129909eb5bf2f9de7db52
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
5cef5a3cfdb51f4a5702ce06fa8a8323
SHA16abe133b0ec46c1f1d9780e5e04c149fb3273fa5
SHA25624efb0561233fa56367f1d229660a8f756e83e875e1836de1f75e74a199a6653
SHA512ce4fe63ea62908b0fc39c08c2629475606921b4b9aba2731f1f7b2066161d2c8f7d705e68a26954749447d2dac75d7b1da075b9c88d129909eb5bf2f9de7db52
-
memory/748-16-0x0000000000000000-mapping.dmp
-
memory/1012-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1012-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1012-24-0x000000000040B000-mapping.dmp
-
memory/2328-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-3-0x000000000040B000-mapping.dmp
-
memory/2328-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2448-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2448-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2448-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2448-8-0x00000000004085D0-mapping.dmp
-
memory/3408-32-0x0000000072E10000-0x0000000072EA3000-memory.dmpFilesize
588KB
-
memory/3408-30-0x00000000004085D0-mapping.dmp
-
memory/3512-20-0x0000000072E10000-0x0000000072EA3000-memory.dmpFilesize
588KB
-
memory/3512-17-0x0000000000000000-mapping.dmp
-
memory/3856-33-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3856-38-0x0000000072E10000-0x0000000072EA3000-memory.dmpFilesize
588KB
-
memory/3856-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3856-35-0x00000000004B5210-mapping.dmp
-
memory/3856-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4092-14-0x0000000000000000-mapping.dmp