Analysis
-
max time kernel
15s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe
Resource
win7v20201028
General
-
Target
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe
-
Size
1.5MB
-
MD5
2278456ba291dd755ca8369f99753de8
-
SHA1
654f8f36b584499394d8370804e37a86caba18e0
-
SHA256
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225
-
SHA512
f8552858829cabb3dedd00a31f6b20137290ddf41a136639be2bb5a6ecd898db5a11008dd3ceb1406deab694c8471e05aec2377a1282090d76b96b794148ae71
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3228 ichader.exe 728 ichader.exe 2212 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/2832-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2832-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2832-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2212-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2212-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2212-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exeichader.exedescription pid process target process PID 640 set thread context of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 set thread context of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 3228 set thread context of 2316 3228 ichader.exe svchost.exe PID 3228 set thread context of 728 3228 ichader.exe ichader.exe PID 3228 set thread context of 2212 3228 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe 3188 svchost.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 2212 ichader.exe Token: SeSecurityPrivilege 2212 ichader.exe Token: SeTakeOwnershipPrivilege 2212 ichader.exe Token: SeLoadDriverPrivilege 2212 ichader.exe Token: SeSystemProfilePrivilege 2212 ichader.exe Token: SeSystemtimePrivilege 2212 ichader.exe Token: SeProfSingleProcessPrivilege 2212 ichader.exe Token: SeIncBasePriorityPrivilege 2212 ichader.exe Token: SeCreatePagefilePrivilege 2212 ichader.exe Token: SeBackupPrivilege 2212 ichader.exe Token: SeRestorePrivilege 2212 ichader.exe Token: SeShutdownPrivilege 2212 ichader.exe Token: SeDebugPrivilege 2212 ichader.exe Token: SeSystemEnvironmentPrivilege 2212 ichader.exe Token: SeChangeNotifyPrivilege 2212 ichader.exe Token: SeRemoteShutdownPrivilege 2212 ichader.exe Token: SeUndockPrivilege 2212 ichader.exe Token: SeManageVolumePrivilege 2212 ichader.exe Token: SeImpersonatePrivilege 2212 ichader.exe Token: SeCreateGlobalPrivilege 2212 ichader.exe Token: 33 2212 ichader.exe Token: 34 2212 ichader.exe Token: 35 2212 ichader.exe Token: 36 2212 ichader.exe Token: SeDebugPrivilege 728 ichader.exe Token: SeDebugPrivilege 728 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exesvchost.exe151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exeichader.exesvchost.exeichader.exeichader.exepid process 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 3188 svchost.exe 2832 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 3228 ichader.exe 2316 svchost.exe 728 ichader.exe 2212 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.execmd.exeichader.exedescription pid process target process PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 3188 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe svchost.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 640 wrote to memory of 2832 640 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe PID 2832 wrote to memory of 1332 2832 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe cmd.exe PID 2832 wrote to memory of 1332 2832 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe cmd.exe PID 2832 wrote to memory of 1332 2832 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe cmd.exe PID 1332 wrote to memory of 3456 1332 cmd.exe reg.exe PID 1332 wrote to memory of 3456 1332 cmd.exe reg.exe PID 1332 wrote to memory of 3456 1332 cmd.exe reg.exe PID 2832 wrote to memory of 3228 2832 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe ichader.exe PID 2832 wrote to memory of 3228 2832 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe ichader.exe PID 2832 wrote to memory of 3228 2832 151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe ichader.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 2316 3228 ichader.exe svchost.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 728 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe PID 3228 wrote to memory of 2212 3228 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"C:\Users\Admin\AppData\Local\Temp\151c33cf3d3cbc3b4c85cfbeac26d4f120a52c6a5787d5413833ed4b2037f225.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HVUGO.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:3456 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:728 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2212
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HVUGO.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
8e0ab719706626b66f6891ec0b7e47a5
SHA15dad3b6d6a70b20832e927d8ea6af0d6030465e5
SHA2566ad6a8101e4c863e0d98b2dfe50ee768ea7a5453047c57c864356fd326ad311c
SHA5120061272a9c7a5d8d6b7adf1a1327e54f206a8be5f5018ca4e4dd503c80c7abec0638490892c64c69cd299e596369862088b5582a1dde6ae882e8706b4beca4dc
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
8e0ab719706626b66f6891ec0b7e47a5
SHA15dad3b6d6a70b20832e927d8ea6af0d6030465e5
SHA2566ad6a8101e4c863e0d98b2dfe50ee768ea7a5453047c57c864356fd326ad311c
SHA5120061272a9c7a5d8d6b7adf1a1327e54f206a8be5f5018ca4e4dd503c80c7abec0638490892c64c69cd299e596369862088b5582a1dde6ae882e8706b4beca4dc
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
8e0ab719706626b66f6891ec0b7e47a5
SHA15dad3b6d6a70b20832e927d8ea6af0d6030465e5
SHA2566ad6a8101e4c863e0d98b2dfe50ee768ea7a5453047c57c864356fd326ad311c
SHA5120061272a9c7a5d8d6b7adf1a1327e54f206a8be5f5018ca4e4dd503c80c7abec0638490892c64c69cd299e596369862088b5582a1dde6ae882e8706b4beca4dc
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
8e0ab719706626b66f6891ec0b7e47a5
SHA15dad3b6d6a70b20832e927d8ea6af0d6030465e5
SHA2566ad6a8101e4c863e0d98b2dfe50ee768ea7a5453047c57c864356fd326ad311c
SHA5120061272a9c7a5d8d6b7adf1a1327e54f206a8be5f5018ca4e4dd503c80c7abec0638490892c64c69cd299e596369862088b5582a1dde6ae882e8706b4beca4dc
-
memory/728-29-0x00000000004085D0-mapping.dmp
-
memory/728-32-0x0000000073910000-0x00000000739A3000-memory.dmpFilesize
588KB
-
memory/1332-14-0x0000000000000000-mapping.dmp
-
memory/2212-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2212-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2212-35-0x00000000004B5210-mapping.dmp
-
memory/2212-38-0x0000000073910000-0x00000000739A3000-memory.dmpFilesize
588KB
-
memory/2212-33-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2316-24-0x000000000040B000-mapping.dmp
-
memory/2316-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2316-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2832-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2832-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2832-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2832-8-0x00000000004085D0-mapping.dmp
-
memory/3188-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3188-3-0x000000000040B000-mapping.dmp
-
memory/3188-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3188-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3228-20-0x0000000073910000-0x00000000739A3000-memory.dmpFilesize
588KB
-
memory/3228-17-0x0000000000000000-mapping.dmp
-
memory/3456-16-0x0000000000000000-mapping.dmp