Analysis
-
max time kernel
14s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe
Resource
win7v20201028
General
-
Target
248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe
-
Size
1.5MB
-
MD5
368388bd7d8ea845d3e78b9fe35052e2
-
SHA1
7350161b91820035c14c201b4f0f010873537fda
-
SHA256
248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6
-
SHA512
01f21de158447cd7f2bafbcbd32a61bf5491ac2b1dff32e813cd76a3c442f135c3adb34296abb48ad0ef46e81e6f5009aaccbe5c71a1dd0d7cfbf818d8038894
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 2260 ichader.exe 2136 ichader.exe 2268 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/728-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/728-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/728-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2268-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2268-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2268-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exeichader.exedescription pid process target process PID 3336 set thread context of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 set thread context of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 2260 set thread context of 3096 2260 ichader.exe svchost.exe PID 2260 set thread context of 2136 2260 ichader.exe ichader.exe PID 2260 set thread context of 2268 2260 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe 3300 svchost.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 2268 ichader.exe Token: SeSecurityPrivilege 2268 ichader.exe Token: SeTakeOwnershipPrivilege 2268 ichader.exe Token: SeLoadDriverPrivilege 2268 ichader.exe Token: SeSystemProfilePrivilege 2268 ichader.exe Token: SeSystemtimePrivilege 2268 ichader.exe Token: SeProfSingleProcessPrivilege 2268 ichader.exe Token: SeIncBasePriorityPrivilege 2268 ichader.exe Token: SeCreatePagefilePrivilege 2268 ichader.exe Token: SeBackupPrivilege 2268 ichader.exe Token: SeRestorePrivilege 2268 ichader.exe Token: SeShutdownPrivilege 2268 ichader.exe Token: SeDebugPrivilege 2268 ichader.exe Token: SeSystemEnvironmentPrivilege 2268 ichader.exe Token: SeChangeNotifyPrivilege 2268 ichader.exe Token: SeRemoteShutdownPrivilege 2268 ichader.exe Token: SeUndockPrivilege 2268 ichader.exe Token: SeManageVolumePrivilege 2268 ichader.exe Token: SeImpersonatePrivilege 2268 ichader.exe Token: SeCreateGlobalPrivilege 2268 ichader.exe Token: 33 2268 ichader.exe Token: 34 2268 ichader.exe Token: 35 2268 ichader.exe Token: 36 2268 ichader.exe Token: SeDebugPrivilege 2136 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exesvchost.exe248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exeichader.exesvchost.exeichader.exeichader.exepid process 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 3300 svchost.exe 728 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 2260 ichader.exe 3096 svchost.exe 2136 ichader.exe 2268 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.execmd.exeichader.exedescription pid process target process PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 3300 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe svchost.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 3336 wrote to memory of 728 3336 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe PID 728 wrote to memory of 1272 728 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe cmd.exe PID 728 wrote to memory of 1272 728 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe cmd.exe PID 728 wrote to memory of 1272 728 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe cmd.exe PID 1272 wrote to memory of 2800 1272 cmd.exe reg.exe PID 1272 wrote to memory of 2800 1272 cmd.exe reg.exe PID 1272 wrote to memory of 2800 1272 cmd.exe reg.exe PID 728 wrote to memory of 2260 728 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe ichader.exe PID 728 wrote to memory of 2260 728 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe ichader.exe PID 728 wrote to memory of 2260 728 248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe ichader.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 3096 2260 ichader.exe svchost.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2136 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe PID 2260 wrote to memory of 2268 2260 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe"C:\Users\Admin\AppData\Local\Temp\248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe"C:\Users\Admin\AppData\Local\Temp\248392feac8b12fcb295125354044fe32e2dc50c517d12e1c9218793c7cb27e6.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QCKCT.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\QCKCT.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
db36b2b7f00b8a6533ea364cada304f5
SHA1a6db862a087b9c89a321f75bfd25976404475f5c
SHA25678b420901a449d8a20c96775a0844a26d3e6f146132d7f95bde71e8b3752dd28
SHA51279e389f50083595a98dbc39257cd3e15169304d16dc8192f047207734fcbc736cc1a9312fbfbca732090ad44d2ec47ad86cd46152d0e99143b4517887359fbeb
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
db36b2b7f00b8a6533ea364cada304f5
SHA1a6db862a087b9c89a321f75bfd25976404475f5c
SHA25678b420901a449d8a20c96775a0844a26d3e6f146132d7f95bde71e8b3752dd28
SHA51279e389f50083595a98dbc39257cd3e15169304d16dc8192f047207734fcbc736cc1a9312fbfbca732090ad44d2ec47ad86cd46152d0e99143b4517887359fbeb
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
db36b2b7f00b8a6533ea364cada304f5
SHA1a6db862a087b9c89a321f75bfd25976404475f5c
SHA25678b420901a449d8a20c96775a0844a26d3e6f146132d7f95bde71e8b3752dd28
SHA51279e389f50083595a98dbc39257cd3e15169304d16dc8192f047207734fcbc736cc1a9312fbfbca732090ad44d2ec47ad86cd46152d0e99143b4517887359fbeb
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
db36b2b7f00b8a6533ea364cada304f5
SHA1a6db862a087b9c89a321f75bfd25976404475f5c
SHA25678b420901a449d8a20c96775a0844a26d3e6f146132d7f95bde71e8b3752dd28
SHA51279e389f50083595a98dbc39257cd3e15169304d16dc8192f047207734fcbc736cc1a9312fbfbca732090ad44d2ec47ad86cd46152d0e99143b4517887359fbeb
-
memory/728-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/728-9-0x00000000004085D0-mapping.dmp
-
memory/728-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/728-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-14-0x0000000000000000-mapping.dmp
-
memory/2136-32-0x0000000073480000-0x0000000073513000-memory.dmpFilesize
588KB
-
memory/2136-29-0x00000000004085D0-mapping.dmp
-
memory/2260-17-0x0000000000000000-mapping.dmp
-
memory/2260-20-0x0000000073480000-0x0000000073513000-memory.dmpFilesize
588KB
-
memory/2268-34-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2268-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2268-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2268-38-0x0000000073480000-0x0000000073513000-memory.dmpFilesize
588KB
-
memory/2268-36-0x00000000004B5210-mapping.dmp
-
memory/2800-16-0x0000000000000000-mapping.dmp
-
memory/3096-24-0x000000000040B000-mapping.dmp
-
memory/3096-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3096-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3300-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3300-3-0x000000000040B000-mapping.dmp
-
memory/3300-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3300-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB