Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe
Resource
win7v20201028
General
-
Target
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe
-
Size
1.5MB
-
MD5
3b5990f8f76c2d055ec864c29ea33474
-
SHA1
dd6e3d2b7f1863e57ca251d755ef088d516bd6be
-
SHA256
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c
-
SHA512
b6df346f3ebd91e08b0822ac3a29c6ed122a9d61451e8e6fd540b89890e4d760cf099057f2378e0911813cd93ed879f7109bf5a54126e3661defbe72f4a005a2
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3448 ichader.exe 1232 ichader.exe 4068 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/904-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/904-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/904-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4068-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4068-37-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4068-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exeichader.exedescription pid process target process PID 1036 set thread context of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 set thread context of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 3448 set thread context of 2604 3448 ichader.exe svchost.exe PID 3448 set thread context of 1232 3448 ichader.exe ichader.exe PID 3448 set thread context of 4068 3448 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1108 2604 WerFault.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe 3120 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 4068 ichader.exe Token: SeSecurityPrivilege 4068 ichader.exe Token: SeTakeOwnershipPrivilege 4068 ichader.exe Token: SeLoadDriverPrivilege 4068 ichader.exe Token: SeSystemProfilePrivilege 4068 ichader.exe Token: SeSystemtimePrivilege 4068 ichader.exe Token: SeProfSingleProcessPrivilege 4068 ichader.exe Token: SeIncBasePriorityPrivilege 4068 ichader.exe Token: SeCreatePagefilePrivilege 4068 ichader.exe Token: SeBackupPrivilege 4068 ichader.exe Token: SeRestorePrivilege 4068 ichader.exe Token: SeShutdownPrivilege 4068 ichader.exe Token: SeDebugPrivilege 4068 ichader.exe Token: SeSystemEnvironmentPrivilege 4068 ichader.exe Token: SeChangeNotifyPrivilege 4068 ichader.exe Token: SeRemoteShutdownPrivilege 4068 ichader.exe Token: SeUndockPrivilege 4068 ichader.exe Token: SeManageVolumePrivilege 4068 ichader.exe Token: SeImpersonatePrivilege 4068 ichader.exe Token: SeCreateGlobalPrivilege 4068 ichader.exe Token: 33 4068 ichader.exe Token: 34 4068 ichader.exe Token: 35 4068 ichader.exe Token: 36 4068 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe Token: SeDebugPrivilege 1232 ichader.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exesvchost.exeed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exeichader.exeichader.exeichader.exepid process 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe 3120 svchost.exe 904 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe 3448 ichader.exe 1232 ichader.exe 4068 ichader.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exeed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.execmd.exeichader.exedescription pid process target process PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 3120 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe svchost.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 1036 wrote to memory of 904 1036 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe PID 904 wrote to memory of 3944 904 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe cmd.exe PID 904 wrote to memory of 3944 904 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe cmd.exe PID 904 wrote to memory of 3944 904 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe cmd.exe PID 3944 wrote to memory of 3400 3944 cmd.exe reg.exe PID 3944 wrote to memory of 3400 3944 cmd.exe reg.exe PID 3944 wrote to memory of 3400 3944 cmd.exe reg.exe PID 904 wrote to memory of 3448 904 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ichader.exe PID 904 wrote to memory of 3448 904 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ichader.exe PID 904 wrote to memory of 3448 904 ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe ichader.exe PID 3448 wrote to memory of 2604 3448 ichader.exe svchost.exe PID 3448 wrote to memory of 2604 3448 ichader.exe svchost.exe PID 3448 wrote to memory of 2604 3448 ichader.exe svchost.exe PID 3448 wrote to memory of 2604 3448 ichader.exe svchost.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 1232 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe PID 3448 wrote to memory of 4068 3448 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"C:\Users\Admin\AppData\Local\Temp\ed29c3cbe6c9859f90ba8cd6482165e634c83eaf1035b8e208356261e887e41c.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKXEN.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 925⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LKXEN.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
3dc9099c50a41a3d6ab72fd0a5f28909
SHA1a7d9345fc1167841a8875124a8346186f4470fae
SHA25607617a3f8e3a8365a6a6a21c64dc1eafaa3f7c6d11459f86d742479a4460c995
SHA512e5621c2e44f5a907e70331e6964b286cdfa8ad66385bd5f7c2a9c93e80818f14996716adf08504d71ff7faa7c9dfc07e614a1884baad7c3638a1ae04791202ca
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
3dc9099c50a41a3d6ab72fd0a5f28909
SHA1a7d9345fc1167841a8875124a8346186f4470fae
SHA25607617a3f8e3a8365a6a6a21c64dc1eafaa3f7c6d11459f86d742479a4460c995
SHA512e5621c2e44f5a907e70331e6964b286cdfa8ad66385bd5f7c2a9c93e80818f14996716adf08504d71ff7faa7c9dfc07e614a1884baad7c3638a1ae04791202ca
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
3dc9099c50a41a3d6ab72fd0a5f28909
SHA1a7d9345fc1167841a8875124a8346186f4470fae
SHA25607617a3f8e3a8365a6a6a21c64dc1eafaa3f7c6d11459f86d742479a4460c995
SHA512e5621c2e44f5a907e70331e6964b286cdfa8ad66385bd5f7c2a9c93e80818f14996716adf08504d71ff7faa7c9dfc07e614a1884baad7c3638a1ae04791202ca
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
3dc9099c50a41a3d6ab72fd0a5f28909
SHA1a7d9345fc1167841a8875124a8346186f4470fae
SHA25607617a3f8e3a8365a6a6a21c64dc1eafaa3f7c6d11459f86d742479a4460c995
SHA512e5621c2e44f5a907e70331e6964b286cdfa8ad66385bd5f7c2a9c93e80818f14996716adf08504d71ff7faa7c9dfc07e614a1884baad7c3638a1ae04791202ca
-
memory/904-9-0x00000000004085D0-mapping.dmp
-
memory/904-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/904-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/904-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1108-35-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/1232-28-0x0000000072DA0000-0x0000000072E33000-memory.dmpFilesize
588KB
-
memory/1232-26-0x00000000004085D0-mapping.dmp
-
memory/2604-24-0x000000000040B000-mapping.dmp
-
memory/3120-3-0x000000000040B000-mapping.dmp
-
memory/3120-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3120-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3120-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3400-16-0x0000000000000000-mapping.dmp
-
memory/3448-20-0x0000000072DA0000-0x0000000072E33000-memory.dmpFilesize
588KB
-
memory/3448-17-0x0000000000000000-mapping.dmp
-
memory/3944-14-0x0000000000000000-mapping.dmp
-
memory/4068-29-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4068-31-0x00000000004B5210-mapping.dmp
-
memory/4068-37-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4068-34-0x0000000072DA0000-0x0000000072E33000-memory.dmpFilesize
588KB
-
memory/4068-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB