Analysis
-
max time kernel
119s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:50
Static task
static1
Behavioral task
behavioral1
Sample
d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe
Resource
win7v20201028
General
-
Target
d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe
-
Size
1.5MB
-
MD5
f781984780ee83c5d8997f283b53ada0
-
SHA1
cc49354a74005d5c6e19bbd0b7628d563211638e
-
SHA256
d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb
-
SHA512
e598a6745b4d3a85a828c2090e1f706ed692b2b7545e2781243512f0963cfe2f337efe4c456ab42a2e421b9a49dd30014324014d1af54bd30cc7e817d7ff0d23
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 940 ichader.exe 1324 ichader.exe 2072 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3196-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3196-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3196-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2072-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2072-37-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2072-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exeichader.exedescription pid process target process PID 816 set thread context of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 set thread context of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 940 set thread context of 2820 940 ichader.exe svchost.exe PID 940 set thread context of 1324 940 ichader.exe ichader.exe PID 940 set thread context of 2072 940 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2108 2820 WerFault.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 2072 ichader.exe Token: SeSecurityPrivilege 2072 ichader.exe Token: SeTakeOwnershipPrivilege 2072 ichader.exe Token: SeLoadDriverPrivilege 2072 ichader.exe Token: SeSystemProfilePrivilege 2072 ichader.exe Token: SeSystemtimePrivilege 2072 ichader.exe Token: SeProfSingleProcessPrivilege 2072 ichader.exe Token: SeIncBasePriorityPrivilege 2072 ichader.exe Token: SeCreatePagefilePrivilege 2072 ichader.exe Token: SeBackupPrivilege 2072 ichader.exe Token: SeRestorePrivilege 2072 ichader.exe Token: SeShutdownPrivilege 2072 ichader.exe Token: SeDebugPrivilege 2072 ichader.exe Token: SeSystemEnvironmentPrivilege 2072 ichader.exe Token: SeChangeNotifyPrivilege 2072 ichader.exe Token: SeRemoteShutdownPrivilege 2072 ichader.exe Token: SeUndockPrivilege 2072 ichader.exe Token: SeManageVolumePrivilege 2072 ichader.exe Token: SeImpersonatePrivilege 2072 ichader.exe Token: SeCreateGlobalPrivilege 2072 ichader.exe Token: 33 2072 ichader.exe Token: 34 2072 ichader.exe Token: 35 2072 ichader.exe Token: 36 2072 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe Token: SeDebugPrivilege 1324 ichader.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exesvchost.exed372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exeichader.exeichader.exeichader.exepid process 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe 1764 svchost.exe 3196 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe 940 ichader.exe 1324 ichader.exe 2072 ichader.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exed372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.execmd.exeichader.exedescription pid process target process PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 1764 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe svchost.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 816 wrote to memory of 3196 816 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe PID 3196 wrote to memory of 648 3196 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe cmd.exe PID 3196 wrote to memory of 648 3196 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe cmd.exe PID 3196 wrote to memory of 648 3196 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe cmd.exe PID 648 wrote to memory of 2392 648 cmd.exe reg.exe PID 648 wrote to memory of 2392 648 cmd.exe reg.exe PID 648 wrote to memory of 2392 648 cmd.exe reg.exe PID 3196 wrote to memory of 940 3196 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe ichader.exe PID 3196 wrote to memory of 940 3196 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe ichader.exe PID 3196 wrote to memory of 940 3196 d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe ichader.exe PID 940 wrote to memory of 2820 940 ichader.exe svchost.exe PID 940 wrote to memory of 2820 940 ichader.exe svchost.exe PID 940 wrote to memory of 2820 940 ichader.exe svchost.exe PID 940 wrote to memory of 2820 940 ichader.exe svchost.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 1324 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe PID 940 wrote to memory of 2072 940 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe"C:\Users\Admin\AppData\Local\Temp\d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe"C:\Users\Admin\AppData\Local\Temp\d372fce4dc8842dc2295d9464600f1450d90fa5554a13b1b7183cb3dba0aa0cb.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WMNKT.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1005⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WMNKT.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9a750543dd75dca1b2e023eacf4d0712
SHA156e7cdef7a2a686e15966d46247af6ac031927a8
SHA256e033dfbf7996e4f6829ee70fc335902cf9fcbcf1c2c239f229fb58b67f7b7820
SHA51240474a48eb0ce981f8790ddb0941c9b141979ffbf153c38d02a076418a66dfdb0ee8e35f1fdd55312245805af39b3f8d6e65d060ef052448f2d795229845d883
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9a750543dd75dca1b2e023eacf4d0712
SHA156e7cdef7a2a686e15966d46247af6ac031927a8
SHA256e033dfbf7996e4f6829ee70fc335902cf9fcbcf1c2c239f229fb58b67f7b7820
SHA51240474a48eb0ce981f8790ddb0941c9b141979ffbf153c38d02a076418a66dfdb0ee8e35f1fdd55312245805af39b3f8d6e65d060ef052448f2d795229845d883
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9a750543dd75dca1b2e023eacf4d0712
SHA156e7cdef7a2a686e15966d46247af6ac031927a8
SHA256e033dfbf7996e4f6829ee70fc335902cf9fcbcf1c2c239f229fb58b67f7b7820
SHA51240474a48eb0ce981f8790ddb0941c9b141979ffbf153c38d02a076418a66dfdb0ee8e35f1fdd55312245805af39b3f8d6e65d060ef052448f2d795229845d883
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
9a750543dd75dca1b2e023eacf4d0712
SHA156e7cdef7a2a686e15966d46247af6ac031927a8
SHA256e033dfbf7996e4f6829ee70fc335902cf9fcbcf1c2c239f229fb58b67f7b7820
SHA51240474a48eb0ce981f8790ddb0941c9b141979ffbf153c38d02a076418a66dfdb0ee8e35f1fdd55312245805af39b3f8d6e65d060ef052448f2d795229845d883
-
memory/648-14-0x0000000000000000-mapping.dmp
-
memory/940-20-0x0000000073B80000-0x0000000073C13000-memory.dmpFilesize
588KB
-
memory/940-17-0x0000000000000000-mapping.dmp
-
memory/1324-28-0x0000000073B80000-0x0000000073C13000-memory.dmpFilesize
588KB
-
memory/1324-26-0x00000000004085D0-mapping.dmp
-
memory/1764-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1764-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1764-3-0x000000000040B000-mapping.dmp
-
memory/1764-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2072-31-0x00000000004B5210-mapping.dmp
-
memory/2072-29-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2072-34-0x0000000073B80000-0x0000000073C13000-memory.dmpFilesize
588KB
-
memory/2072-37-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2072-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2108-36-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/2392-16-0x0000000000000000-mapping.dmp
-
memory/2820-24-0x000000000040B000-mapping.dmp
-
memory/3196-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3196-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3196-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3196-8-0x00000000004085D0-mapping.dmp