Analysis
-
max time kernel
19s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe
Resource
win7v20201028
General
-
Target
f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe
-
Size
1.5MB
-
MD5
15e68274a502d0a3f916e822661d0261
-
SHA1
0284a494e76ce1339b238fcb2b2c920e5fca23e5
-
SHA256
f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e
-
SHA512
6949fe8adb56018cb586be580a845a4a5c4ced0709937091cf48397002fc2f35fba221ff4b76c69ea713d09934404ebd0303ff9299cdf61fd7730bc81a89dcd3
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 1020 ichader.exe 3584 ichader.exe 3136 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3160-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3160-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3160-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3136-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3136-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3136-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exeichader.exedescription pid process target process PID 508 set thread context of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 set thread context of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 1020 set thread context of 1264 1020 ichader.exe svchost.exe PID 1020 set thread context of 3584 1020 ichader.exe ichader.exe PID 1020 set thread context of 3136 1020 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe 2700 svchost.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 3136 ichader.exe Token: SeSecurityPrivilege 3136 ichader.exe Token: SeTakeOwnershipPrivilege 3136 ichader.exe Token: SeLoadDriverPrivilege 3136 ichader.exe Token: SeSystemProfilePrivilege 3136 ichader.exe Token: SeSystemtimePrivilege 3136 ichader.exe Token: SeProfSingleProcessPrivilege 3136 ichader.exe Token: SeIncBasePriorityPrivilege 3136 ichader.exe Token: SeCreatePagefilePrivilege 3136 ichader.exe Token: SeBackupPrivilege 3136 ichader.exe Token: SeRestorePrivilege 3136 ichader.exe Token: SeShutdownPrivilege 3136 ichader.exe Token: SeDebugPrivilege 3136 ichader.exe Token: SeSystemEnvironmentPrivilege 3136 ichader.exe Token: SeChangeNotifyPrivilege 3136 ichader.exe Token: SeRemoteShutdownPrivilege 3136 ichader.exe Token: SeUndockPrivilege 3136 ichader.exe Token: SeManageVolumePrivilege 3136 ichader.exe Token: SeImpersonatePrivilege 3136 ichader.exe Token: SeCreateGlobalPrivilege 3136 ichader.exe Token: 33 3136 ichader.exe Token: 34 3136 ichader.exe Token: 35 3136 ichader.exe Token: 36 3136 ichader.exe Token: SeDebugPrivilege 3584 ichader.exe Token: SeDebugPrivilege 3584 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exesvchost.exef07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exeichader.exesvchost.exeichader.exeichader.exepid process 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe 2700 svchost.exe 3160 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe 1020 ichader.exe 1264 svchost.exe 3584 ichader.exe 3136 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exef07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.execmd.exeichader.exedescription pid process target process PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 2700 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe svchost.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 508 wrote to memory of 3160 508 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe PID 3160 wrote to memory of 3076 3160 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe cmd.exe PID 3160 wrote to memory of 3076 3160 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe cmd.exe PID 3160 wrote to memory of 3076 3160 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe cmd.exe PID 3076 wrote to memory of 2360 3076 cmd.exe reg.exe PID 3076 wrote to memory of 2360 3076 cmd.exe reg.exe PID 3076 wrote to memory of 2360 3076 cmd.exe reg.exe PID 3160 wrote to memory of 1020 3160 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe ichader.exe PID 3160 wrote to memory of 1020 3160 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe ichader.exe PID 3160 wrote to memory of 1020 3160 f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe ichader.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 1264 1020 ichader.exe svchost.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3584 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe PID 1020 wrote to memory of 3136 1020 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe"C:\Users\Admin\AppData\Local\Temp\f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe"C:\Users\Admin\AppData\Local\Temp\f07a791d33d9cf7db68c0925b8b254682a703ac53eb8188e1e996af91d0c348e.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HWXUD.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HWXUD.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
32736e72bac44b38767a6fb34b4702a3
SHA1c4e47904c85f17b7652980092ca1c8e2560b1767
SHA256e0fccc5cca9db634246e5b1cbf615b6576206e4850caabc24d4903e70f9a80d5
SHA512a1d567dc6fd2236c60cdb5bc4b7b8f904875477d4e159a0d7c2e99190900cfb702b54b3f9a747f0d6915602e19992a041eed0c1fe2024114b64cf781322f034a
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
32736e72bac44b38767a6fb34b4702a3
SHA1c4e47904c85f17b7652980092ca1c8e2560b1767
SHA256e0fccc5cca9db634246e5b1cbf615b6576206e4850caabc24d4903e70f9a80d5
SHA512a1d567dc6fd2236c60cdb5bc4b7b8f904875477d4e159a0d7c2e99190900cfb702b54b3f9a747f0d6915602e19992a041eed0c1fe2024114b64cf781322f034a
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
32736e72bac44b38767a6fb34b4702a3
SHA1c4e47904c85f17b7652980092ca1c8e2560b1767
SHA256e0fccc5cca9db634246e5b1cbf615b6576206e4850caabc24d4903e70f9a80d5
SHA512a1d567dc6fd2236c60cdb5bc4b7b8f904875477d4e159a0d7c2e99190900cfb702b54b3f9a747f0d6915602e19992a041eed0c1fe2024114b64cf781322f034a
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
32736e72bac44b38767a6fb34b4702a3
SHA1c4e47904c85f17b7652980092ca1c8e2560b1767
SHA256e0fccc5cca9db634246e5b1cbf615b6576206e4850caabc24d4903e70f9a80d5
SHA512a1d567dc6fd2236c60cdb5bc4b7b8f904875477d4e159a0d7c2e99190900cfb702b54b3f9a747f0d6915602e19992a041eed0c1fe2024114b64cf781322f034a
-
memory/1020-17-0x0000000000000000-mapping.dmp
-
memory/1020-20-0x0000000072E70000-0x0000000072F03000-memory.dmpFilesize
588KB
-
memory/1264-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1264-24-0x000000000040B000-mapping.dmp
-
memory/1264-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2360-16-0x0000000000000000-mapping.dmp
-
memory/2700-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2700-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2700-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2700-3-0x000000000040B000-mapping.dmp
-
memory/3076-14-0x0000000000000000-mapping.dmp
-
memory/3136-38-0x0000000072E70000-0x0000000072F03000-memory.dmpFilesize
588KB
-
memory/3136-36-0x00000000004B5210-mapping.dmp
-
memory/3136-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3136-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3136-34-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3160-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3160-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3160-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3160-8-0x00000000004085D0-mapping.dmp
-
memory/3584-31-0x0000000072E70000-0x0000000072F03000-memory.dmpFilesize
588KB
-
memory/3584-28-0x00000000004085D0-mapping.dmp