Analysis
-
max time kernel
4s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:50
Static task
static1
Behavioral task
behavioral1
Sample
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe
Resource
win7v20201028
General
-
Target
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe
-
Size
1.5MB
-
MD5
6fe13c3acf1aa29ad394003165a1196a
-
SHA1
7d3854a4c908aa96c06abc4ba928306364e31fe5
-
SHA256
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8
-
SHA512
574355399c3765ae62079a2a807147da6d28db7691c2c6bba862ee0991091829be7c2ca521cf8057cd37738572a209ee98aad4bda7fdc0818f7ee06e60bc7c81
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1760-34-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1760-37-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1760-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1096-95-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1096-101-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1096-102-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exedescription pid process target process PID 1876 set thread context of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 set thread context of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exesvchost.exe77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exepid process 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 1776 svchost.exe 1760 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exedescription pid process target process PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1776 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1876 wrote to memory of 1760 1876 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1760
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GOCEW.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
45b119752f06709d9d612920124cc0f9
SHA1d771850c053fd95fffd5b1a8e85c11573398051d
SHA2562182079b74133b200ee2d4d5beb9f71114b5a6f600012ca7467ca59392b20a07
SHA512f2dd71497cfb6ff64d2854ee8a451e30d61e8bda82881e85c94f22d37efd78102b1c7af626e5aa2cc8d44d3a753093c32a2de93ec37e2d5b05ab9598afe7ae55
-
memory/524-90-0x00000000004085D0-mapping.dmp
-
memory/1032-45-0x0000000000000000-mapping.dmp
-
memory/1064-71-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-77-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-83-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-82-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-81-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-80-0x0000000000618000-0x0000000000619000-memory.dmpFilesize
4KB
-
memory/1064-79-0x0000000000618000-0x0000000000619000-memory.dmpFilesize
4KB
-
memory/1064-78-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-76-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-75-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-72-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-70-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-69-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-66-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-65-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-64-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-63-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-62-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-61-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-60-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-59-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-58-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-57-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-56-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-55-0x0000000000616000-0x0000000000617000-memory.dmpFilesize
4KB
-
memory/1064-51-0x0000000000000000-mapping.dmp
-
memory/1096-102-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1096-101-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1096-97-0x00000000004B5210-mapping.dmp
-
memory/1096-95-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1536-85-0x000000000040B000-mapping.dmp
-
memory/1536-86-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1536-84-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1648-43-0x0000000000000000-mapping.dmp
-
memory/1760-37-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1760-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1760-35-0x00000000004085D0-mapping.dmp
-
memory/1760-34-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-32-0x000000000040B000-mapping.dmp
-
memory/1776-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1776-36-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1776-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1876-4-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-10-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-29-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-2-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-30-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-26-0x00000000006D8000-0x00000000006D9000-memory.dmpFilesize
4KB
-
memory/1876-27-0x00000000006D8000-0x00000000006D9000-memory.dmpFilesize
4KB
-
memory/1876-11-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-3-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-18-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-5-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-8-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-9-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-28-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-12-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-24-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-13-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-25-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-6-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-16-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-17-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-23-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-7-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-22-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1876-19-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB