Analysis
-
max time kernel
7s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe
Resource
win7v20201028
General
-
Target
1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe
-
Size
1.5MB
-
MD5
21fb7cfb4b6889927dc2cc02307b6bc3
-
SHA1
7461b416f7da583f84ec4d1b5215af977b736f15
-
SHA256
1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c
-
SHA512
00816bba8729485dacfff1596c0b3c32fac3395ce5739ffa1833217b54d76e8263af586a3cabebe579c58e3d8d7580977faca61a0ac5d5f001ac18f50466743d
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 672 ichader.exe 4068 ichader.exe 1180 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3228-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3228-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3228-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1180-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1180-40-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1180-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exeichader.exedescription pid process target process PID 652 set thread context of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 set thread context of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 672 set thread context of 1528 672 ichader.exe svchost.exe PID 672 set thread context of 4068 672 ichader.exe ichader.exe PID 672 set thread context of 1180 672 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe 1592 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 1180 ichader.exe Token: SeSecurityPrivilege 1180 ichader.exe Token: SeTakeOwnershipPrivilege 1180 ichader.exe Token: SeLoadDriverPrivilege 1180 ichader.exe Token: SeSystemProfilePrivilege 1180 ichader.exe Token: SeSystemtimePrivilege 1180 ichader.exe Token: SeProfSingleProcessPrivilege 1180 ichader.exe Token: SeIncBasePriorityPrivilege 1180 ichader.exe Token: SeCreatePagefilePrivilege 1180 ichader.exe Token: SeBackupPrivilege 1180 ichader.exe Token: SeRestorePrivilege 1180 ichader.exe Token: SeShutdownPrivilege 1180 ichader.exe Token: SeDebugPrivilege 1180 ichader.exe Token: SeSystemEnvironmentPrivilege 1180 ichader.exe Token: SeChangeNotifyPrivilege 1180 ichader.exe Token: SeRemoteShutdownPrivilege 1180 ichader.exe Token: SeUndockPrivilege 1180 ichader.exe Token: SeManageVolumePrivilege 1180 ichader.exe Token: SeImpersonatePrivilege 1180 ichader.exe Token: SeCreateGlobalPrivilege 1180 ichader.exe Token: 33 1180 ichader.exe Token: 34 1180 ichader.exe Token: 35 1180 ichader.exe Token: 36 1180 ichader.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exesvchost.exe1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exeichader.exesvchost.exeichader.exepid process 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1592 svchost.exe 3228 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 672 ichader.exe 1528 svchost.exe 4068 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.execmd.exeichader.exedescription pid process target process PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 1592 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe svchost.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 652 wrote to memory of 3228 652 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe PID 3228 wrote to memory of 188 3228 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe cmd.exe PID 3228 wrote to memory of 188 3228 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe cmd.exe PID 3228 wrote to memory of 188 3228 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe cmd.exe PID 188 wrote to memory of 3348 188 cmd.exe reg.exe PID 188 wrote to memory of 3348 188 cmd.exe reg.exe PID 188 wrote to memory of 3348 188 cmd.exe reg.exe PID 3228 wrote to memory of 672 3228 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe ichader.exe PID 3228 wrote to memory of 672 3228 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe ichader.exe PID 3228 wrote to memory of 672 3228 1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe ichader.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 1528 672 ichader.exe svchost.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 4068 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe PID 672 wrote to memory of 1180 672 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe"C:\Users\Admin\AppData\Local\Temp\1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe"C:\Users\Admin\AppData\Local\Temp\1fc15fc0d494f0441923e5237e214545cc13d0f73759d70da6d4a784a2ef8b1c.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GLGNC.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GLGNC.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
146445ecf21e31bb9388672884425ed5
SHA107e256e55d835381d09222cf7ad06c173f3e745e
SHA25680d5ea8d44c7520f0dd00537628ca73163cbfd7a2cc9bb0cfd8e80b6af260fa8
SHA512442b20a93ee19cb3982ad23f206bd0053bfacdeeb92cba7c82336baf697108bc4597aa24c261b232f70bbf4b403d74d6a44bfe41b25009e2355b371298fca292
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
146445ecf21e31bb9388672884425ed5
SHA107e256e55d835381d09222cf7ad06c173f3e745e
SHA25680d5ea8d44c7520f0dd00537628ca73163cbfd7a2cc9bb0cfd8e80b6af260fa8
SHA512442b20a93ee19cb3982ad23f206bd0053bfacdeeb92cba7c82336baf697108bc4597aa24c261b232f70bbf4b403d74d6a44bfe41b25009e2355b371298fca292
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
146445ecf21e31bb9388672884425ed5
SHA107e256e55d835381d09222cf7ad06c173f3e745e
SHA25680d5ea8d44c7520f0dd00537628ca73163cbfd7a2cc9bb0cfd8e80b6af260fa8
SHA512442b20a93ee19cb3982ad23f206bd0053bfacdeeb92cba7c82336baf697108bc4597aa24c261b232f70bbf4b403d74d6a44bfe41b25009e2355b371298fca292
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
-
memory/188-14-0x0000000000000000-mapping.dmp
-
memory/672-17-0x0000000000000000-mapping.dmp
-
memory/672-20-0x0000000073B00000-0x0000000073B93000-memory.dmpFilesize
588KB
-
memory/1180-36-0x00000000004B5210-mapping.dmp
-
memory/1180-40-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1180-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1180-38-0x0000000073B00000-0x0000000073B93000-memory.dmpFilesize
588KB
-
memory/1180-34-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1528-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1528-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1528-24-0x000000000040B000-mapping.dmp
-
memory/1592-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1592-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1592-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1592-3-0x000000000040B000-mapping.dmp
-
memory/3228-8-0x00000000004085D0-mapping.dmp
-
memory/3228-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3228-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3228-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3348-16-0x0000000000000000-mapping.dmp
-
memory/4068-32-0x0000000073B00000-0x0000000073B93000-memory.dmpFilesize
588KB
-
memory/4068-30-0x00000000004085D0-mapping.dmp