Analysis
-
max time kernel
13s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe
Resource
win7v20201028
General
-
Target
6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe
-
Size
1.5MB
-
MD5
142ca1586ebf110c896a2081ee5b9897
-
SHA1
25675d558ee4bae0e32c78b1d150fa3a1a27666e
-
SHA256
6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604
-
SHA512
53266437a8411f8fb1ce9f5d9494de3f73b5b3c948974313b62f4f3b3ee172a092151f59c4ac622255213d31ef25a06bd6ca8654ef0557a25cc9ca0ebe4c468c
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 744 ichader.exe 1976 ichader.exe 1980 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/2976-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2976-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1980-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1980-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1980-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exeichader.exedescription pid process target process PID 648 set thread context of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 set thread context of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 744 set thread context of 2224 744 ichader.exe svchost.exe PID 744 set thread context of 1976 744 ichader.exe ichader.exe PID 744 set thread context of 1980 744 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe 2680 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 1980 ichader.exe Token: SeSecurityPrivilege 1980 ichader.exe Token: SeTakeOwnershipPrivilege 1980 ichader.exe Token: SeLoadDriverPrivilege 1980 ichader.exe Token: SeSystemProfilePrivilege 1980 ichader.exe Token: SeSystemtimePrivilege 1980 ichader.exe Token: SeProfSingleProcessPrivilege 1980 ichader.exe Token: SeIncBasePriorityPrivilege 1980 ichader.exe Token: SeCreatePagefilePrivilege 1980 ichader.exe Token: SeBackupPrivilege 1980 ichader.exe Token: SeRestorePrivilege 1980 ichader.exe Token: SeShutdownPrivilege 1980 ichader.exe Token: SeDebugPrivilege 1980 ichader.exe Token: SeSystemEnvironmentPrivilege 1980 ichader.exe Token: SeChangeNotifyPrivilege 1980 ichader.exe Token: SeRemoteShutdownPrivilege 1980 ichader.exe Token: SeUndockPrivilege 1980 ichader.exe Token: SeManageVolumePrivilege 1980 ichader.exe Token: SeImpersonatePrivilege 1980 ichader.exe Token: SeCreateGlobalPrivilege 1980 ichader.exe Token: 33 1980 ichader.exe Token: 34 1980 ichader.exe Token: 35 1980 ichader.exe Token: 36 1980 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exesvchost.exe6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exeichader.exesvchost.exeichader.exeichader.exepid process 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 2680 svchost.exe 2976 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 744 ichader.exe 2224 svchost.exe 1976 ichader.exe 1980 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.execmd.exeichader.exedescription pid process target process PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2680 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe svchost.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 648 wrote to memory of 2976 648 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe PID 2976 wrote to memory of 2836 2976 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe cmd.exe PID 2976 wrote to memory of 2836 2976 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe cmd.exe PID 2976 wrote to memory of 2836 2976 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe cmd.exe PID 2836 wrote to memory of 1940 2836 cmd.exe reg.exe PID 2836 wrote to memory of 1940 2836 cmd.exe reg.exe PID 2836 wrote to memory of 1940 2836 cmd.exe reg.exe PID 2976 wrote to memory of 744 2976 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe ichader.exe PID 2976 wrote to memory of 744 2976 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe ichader.exe PID 2976 wrote to memory of 744 2976 6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe ichader.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 2224 744 ichader.exe svchost.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1976 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe PID 744 wrote to memory of 1980 744 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe"C:\Users\Admin\AppData\Local\Temp\6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe"C:\Users\Admin\AppData\Local\Temp\6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TSENE.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:1940 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1980
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TSENE.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
3bb406f2e39791375f6b79517aaa59cf
SHA1d19093a34a547f547d747a26b6f40570252c643f
SHA256e0dee9fb8d3bc54ab80dbf06cefd32391709861ffac9e80155e95d7ae707110f
SHA5126a932d4a2beaee21ac29cc1794ddbf8b995c2c4ddbf29777da4e3be45e17bad43c69ccb959f53857eb45ec28810367bed9c84b4de9be3fa6215aad642ed92569
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
3bb406f2e39791375f6b79517aaa59cf
SHA1d19093a34a547f547d747a26b6f40570252c643f
SHA256e0dee9fb8d3bc54ab80dbf06cefd32391709861ffac9e80155e95d7ae707110f
SHA5126a932d4a2beaee21ac29cc1794ddbf8b995c2c4ddbf29777da4e3be45e17bad43c69ccb959f53857eb45ec28810367bed9c84b4de9be3fa6215aad642ed92569
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
3bb406f2e39791375f6b79517aaa59cf
SHA1d19093a34a547f547d747a26b6f40570252c643f
SHA256e0dee9fb8d3bc54ab80dbf06cefd32391709861ffac9e80155e95d7ae707110f
SHA5126a932d4a2beaee21ac29cc1794ddbf8b995c2c4ddbf29777da4e3be45e17bad43c69ccb959f53857eb45ec28810367bed9c84b4de9be3fa6215aad642ed92569
-
memory/744-20-0x0000000072BF0000-0x0000000072C83000-memory.dmpFilesize
588KB
-
memory/744-17-0x0000000000000000-mapping.dmp
-
memory/1940-16-0x0000000000000000-mapping.dmp
-
memory/1976-30-0x00000000004085D0-mapping.dmp
-
memory/1976-32-0x0000000072BF0000-0x0000000072C83000-memory.dmpFilesize
588KB
-
memory/1980-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1980-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1980-36-0x00000000004B5210-mapping.dmp
-
memory/1980-38-0x0000000072BF0000-0x0000000072C83000-memory.dmpFilesize
588KB
-
memory/1980-34-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2224-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2224-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2224-24-0x000000000040B000-mapping.dmp
-
memory/2680-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2680-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2680-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2680-3-0x000000000040B000-mapping.dmp
-
memory/2836-14-0x0000000000000000-mapping.dmp
-
memory/2976-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2976-8-0x00000000004085D0-mapping.dmp
-
memory/2976-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2976-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB