Analysis
-
max time kernel
7s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:50
Static task
static1
Behavioral task
behavioral1
Sample
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe
Resource
win7v20201028
General
-
Target
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe
-
Size
1.5MB
-
MD5
6fe13c3acf1aa29ad394003165a1196a
-
SHA1
7d3854a4c908aa96c06abc4ba928306364e31fe5
-
SHA256
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8
-
SHA512
574355399c3765ae62079a2a807147da6d28db7691c2c6bba862ee0991091829be7c2ca521cf8057cd37738572a209ee98aad4bda7fdc0818f7ee06e60bc7c81
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 1548 ichader.exe 3424 ichader.exe 1116 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/2188-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2188-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2188-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1116-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1116-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1116-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exeichader.exedescription pid process target process PID 3160 set thread context of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 set thread context of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 1548 set thread context of 1452 1548 ichader.exe svchost.exe PID 1548 set thread context of 3424 1548 ichader.exe ichader.exe PID 1548 set thread context of 1116 1548 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 1116 ichader.exe Token: SeSecurityPrivilege 1116 ichader.exe Token: SeTakeOwnershipPrivilege 1116 ichader.exe Token: SeLoadDriverPrivilege 1116 ichader.exe Token: SeSystemProfilePrivilege 1116 ichader.exe Token: SeSystemtimePrivilege 1116 ichader.exe Token: SeProfSingleProcessPrivilege 1116 ichader.exe Token: SeIncBasePriorityPrivilege 1116 ichader.exe Token: SeCreatePagefilePrivilege 1116 ichader.exe Token: SeBackupPrivilege 1116 ichader.exe Token: SeRestorePrivilege 1116 ichader.exe Token: SeShutdownPrivilege 1116 ichader.exe Token: SeDebugPrivilege 1116 ichader.exe Token: SeSystemEnvironmentPrivilege 1116 ichader.exe Token: SeChangeNotifyPrivilege 1116 ichader.exe Token: SeRemoteShutdownPrivilege 1116 ichader.exe Token: SeUndockPrivilege 1116 ichader.exe Token: SeManageVolumePrivilege 1116 ichader.exe Token: SeImpersonatePrivilege 1116 ichader.exe Token: SeCreateGlobalPrivilege 1116 ichader.exe Token: 33 1116 ichader.exe Token: 34 1116 ichader.exe Token: 35 1116 ichader.exe Token: 36 1116 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exesvchost.exe77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exeichader.exesvchost.exeichader.exeichader.exepid process 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 1968 svchost.exe 2188 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 1548 ichader.exe 1452 svchost.exe 3424 ichader.exe 1116 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.execmd.exeichader.exedescription pid process target process PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 1968 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe svchost.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 3160 wrote to memory of 2188 3160 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe PID 2188 wrote to memory of 4020 2188 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe cmd.exe PID 2188 wrote to memory of 4020 2188 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe cmd.exe PID 2188 wrote to memory of 4020 2188 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe cmd.exe PID 4020 wrote to memory of 1064 4020 cmd.exe reg.exe PID 4020 wrote to memory of 1064 4020 cmd.exe reg.exe PID 4020 wrote to memory of 1064 4020 cmd.exe reg.exe PID 2188 wrote to memory of 1548 2188 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe ichader.exe PID 2188 wrote to memory of 1548 2188 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe ichader.exe PID 2188 wrote to memory of 1548 2188 77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe ichader.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 1452 1548 ichader.exe svchost.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 3424 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe PID 1548 wrote to memory of 1116 1548 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"C:\Users\Admin\AppData\Local\Temp\77af302242f3b0036f6156e0bc52de70286320e5b6ffeec688fffbc67124dde8.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BAQRO.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BAQRO.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
a49999923f2611f1be39e8bc1c4039f1
SHA16c6ca72856024956bd95dee99dcca1f918322065
SHA256c58f652aac5183dbcb8ec67c68c504b35dad7e813fa3270d9143705ba20c1b1e
SHA5126d209897528ed3f22050c2301e5966d710103a2cff7206f4050cd760f8a3ef59e1b4507b321d087d450556d2cb1f6f1dd512fce9712966cf8e47a6396080c551
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
a49999923f2611f1be39e8bc1c4039f1
SHA16c6ca72856024956bd95dee99dcca1f918322065
SHA256c58f652aac5183dbcb8ec67c68c504b35dad7e813fa3270d9143705ba20c1b1e
SHA5126d209897528ed3f22050c2301e5966d710103a2cff7206f4050cd760f8a3ef59e1b4507b321d087d450556d2cb1f6f1dd512fce9712966cf8e47a6396080c551
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
a49999923f2611f1be39e8bc1c4039f1
SHA16c6ca72856024956bd95dee99dcca1f918322065
SHA256c58f652aac5183dbcb8ec67c68c504b35dad7e813fa3270d9143705ba20c1b1e
SHA5126d209897528ed3f22050c2301e5966d710103a2cff7206f4050cd760f8a3ef59e1b4507b321d087d450556d2cb1f6f1dd512fce9712966cf8e47a6396080c551
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
a49999923f2611f1be39e8bc1c4039f1
SHA16c6ca72856024956bd95dee99dcca1f918322065
SHA256c58f652aac5183dbcb8ec67c68c504b35dad7e813fa3270d9143705ba20c1b1e
SHA5126d209897528ed3f22050c2301e5966d710103a2cff7206f4050cd760f8a3ef59e1b4507b321d087d450556d2cb1f6f1dd512fce9712966cf8e47a6396080c551
-
memory/1064-16-0x0000000000000000-mapping.dmp
-
memory/1116-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1116-37-0x0000000073130000-0x00000000731C3000-memory.dmpFilesize
588KB
-
memory/1116-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1116-32-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1116-35-0x00000000004B5210-mapping.dmp
-
memory/1452-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1452-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1452-24-0x000000000040B000-mapping.dmp
-
memory/1548-20-0x0000000073130000-0x00000000731C3000-memory.dmpFilesize
588KB
-
memory/1548-17-0x0000000000000000-mapping.dmp
-
memory/1968-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1968-3-0x000000000040B000-mapping.dmp
-
memory/1968-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1968-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2188-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2188-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2188-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2188-9-0x00000000004085D0-mapping.dmp
-
memory/3424-31-0x0000000073130000-0x00000000731C3000-memory.dmpFilesize
588KB
-
memory/3424-28-0x00000000004085D0-mapping.dmp
-
memory/4020-14-0x0000000000000000-mapping.dmp