Analysis
-
max time kernel
3s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe
Resource
win7v20201028
General
-
Target
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe
-
Size
1.5MB
-
MD5
2278456ba291dd755ca8369f99753de8
-
SHA1
654f8f36b584499394d8370804e37a86caba18e0
-
SHA256
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
-
SHA512
f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1076-35-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1076-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1076-40-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1748-96-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1748-101-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1748-102-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exedescription pid process target process PID 2036 set thread context of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 set thread context of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe 1636 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exesvchost.exe151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exepid process 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 1636 svchost.exe 1076 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exedescription pid process target process PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1636 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2036 wrote to memory of 1076 2036 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1076
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LCNPK.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
2278456ba291dd755ca8369f99753de8
SHA1654f8f36b584499394d8370804e37a86caba18e0
SHA256151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
SHA512f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
-
memory/532-43-0x0000000000000000-mapping.dmp
-
memory/1076-35-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1076-40-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1076-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1076-37-0x00000000004085D0-mapping.dmp
-
memory/1172-72-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-77-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-83-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-82-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-81-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-80-0x00000000002B8000-0x00000000002B9000-memory.dmpFilesize
4KB
-
memory/1172-79-0x00000000002B8000-0x00000000002B9000-memory.dmpFilesize
4KB
-
memory/1172-78-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-76-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-75-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-71-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-70-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-69-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-63-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-66-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-65-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-64-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-62-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-61-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-60-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-59-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-58-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-57-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-56-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1172-51-0x0000000000000000-mapping.dmp
-
memory/1172-55-0x00000000002B6000-0x00000000002B7000-memory.dmpFilesize
4KB
-
memory/1576-85-0x000000000040B000-mapping.dmp
-
memory/1576-84-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1576-86-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1636-34-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1636-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1636-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1636-32-0x000000000040B000-mapping.dmp
-
memory/1744-45-0x0000000000000000-mapping.dmp
-
memory/1748-102-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1748-101-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1748-97-0x00000000004B5210-mapping.dmp
-
memory/1748-96-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1888-90-0x00000000004085D0-mapping.dmp
-
memory/2036-10-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-6-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-26-0x00000000006C8000-0x00000000006C9000-memory.dmpFilesize
4KB
-
memory/2036-7-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-27-0x00000000006C8000-0x00000000006C9000-memory.dmpFilesize
4KB
-
memory/2036-30-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-29-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-8-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-28-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-2-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-3-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-4-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-5-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-9-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-19-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-24-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-11-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-12-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-25-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-13-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-16-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-23-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-17-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-18-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB
-
memory/2036-22-0x00000000006C6000-0x00000000006C7000-memory.dmpFilesize
4KB