Analysis
-
max time kernel
3s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe
Resource
win7v20201028
General
-
Target
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe
-
Size
1.5MB
-
MD5
3b5990f8f76c2d055ec864c29ea33474
-
SHA1
dd6e3d2b7f1863e57ca251d755ef088d516bd6be
-
SHA256
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c
-
SHA512
b6df346f3ebd91e08b0822ac3a29c6ed122a9d61451e8e6fd540b89890e4d760cf099057f2378e0911813cd93ed879f7109bf5a54126e3661defbe72f4a005a2
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1232-35-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1232-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1232-40-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1964-96-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1964-101-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1964-102-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exedescription pid process target process PID 1644 set thread context of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 set thread context of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe 1560 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exesvchost.exeed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exepid process 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe 1560 svchost.exe 1232 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exedescription pid process target process PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1560 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1644 wrote to memory of 1232 1644 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HTUPN.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
d9c3fa9ec22e35f4765607d46ebe42e2
SHA1bf4634200ce6829db10269ef2e83e02892a799ad
SHA25606d0cb8a7b9dc80de38765dd4a3ad77f63ddaae391a94ef7bbcb346d6936685a
SHA5120e710b75e30badf9dca59806003180a743e75d3064aaae7c94f03a818a10a421ee96db9018ff57609990b6495104b50554ab4fa604e3cafeb641754225634f52
-
memory/304-86-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/304-84-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/304-85-0x000000000040B000-mapping.dmp
-
memory/368-43-0x0000000000000000-mapping.dmp
-
memory/436-71-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-79-0x0000000000718000-0x0000000000719000-memory.dmpFilesize
4KB
-
memory/436-83-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-82-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-81-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-80-0x0000000000718000-0x0000000000719000-memory.dmpFilesize
4KB
-
memory/436-78-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-77-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-76-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-75-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-72-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-70-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-69-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-64-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-66-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-65-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-63-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-62-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-61-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-60-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-59-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-58-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-57-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-56-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-55-0x0000000000716000-0x0000000000717000-memory.dmpFilesize
4KB
-
memory/436-51-0x0000000000000000-mapping.dmp
-
memory/776-45-0x0000000000000000-mapping.dmp
-
memory/1232-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1232-35-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1232-36-0x00000000004085D0-mapping.dmp
-
memory/1232-40-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1560-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1560-32-0x000000000040B000-mapping.dmp
-
memory/1560-34-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1560-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1592-90-0x00000000004085D0-mapping.dmp
-
memory/1644-30-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-23-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-18-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-16-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-12-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-13-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-8-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-3-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-10-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-28-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-29-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-26-0x0000000000258000-0x0000000000259000-memory.dmpFilesize
4KB
-
memory/1644-27-0x0000000000258000-0x0000000000259000-memory.dmpFilesize
4KB
-
memory/1644-19-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-25-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-17-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-24-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-22-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-9-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-7-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-5-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-11-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-6-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-2-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1644-4-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB
-
memory/1964-98-0x00000000004B5210-mapping.dmp
-
memory/1964-96-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1964-101-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1964-102-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB