Analysis
-
max time kernel
3s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe
Resource
win7v20201028
General
-
Target
6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe
-
Size
1.5MB
-
MD5
5e0c56aa4d8ab74ab7c1401c05720f15
-
SHA1
b4f0cfd99d686ce6f724e4328d21edec5f56dd1b
-
SHA256
6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559
-
SHA512
f73bbc8d8cdfd5f8a18f624ea5aee83ce05d6566ad018fd5dd7541202f0d033feb7bf60afcd1f80ea601f2efd0477b1f05feeaa09883f6ce1b3210d5d323e44e
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral1/memory/308-35-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/308-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/308-40-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1760-96-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1760-101-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1760-102-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exedescription pid process target process PID 1808 set thread context of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 set thread context of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exesvchost.exe6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exepid process 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 852 svchost.exe 308 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exedescription pid process target process PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 852 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe svchost.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe PID 1808 wrote to memory of 308 1808 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe 6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe"C:\Users\Admin\AppData\Local\Temp\6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe"C:\Users\Admin\AppData\Local\Temp\6710915f32e35614181300eba4f4b49e24bbda5774f31abf84b78552565a8559.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:308
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WADTP.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
290f8d27708a06cbdb6edcca5d7e9eab
SHA108aae2ddca4b93123f61eddf5fe74dfe855f5e30
SHA256d790085d2a9ad1bb6845dbad08921e1f6e48c1bdd04d356a9a1d79e0dfb926c9
SHA5123502df4fa63e05755ef32b1f806a98eefb233ac50db50a00166189865a9d03bddc21c5beb21b2e93ba1300ac3707713df9a6a992422f5b22d214440b129959ba
-
memory/308-40-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/308-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/308-37-0x00000000004085D0-mapping.dmp
-
memory/308-35-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/852-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/852-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/852-34-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/852-32-0x000000000040B000-mapping.dmp
-
memory/1044-45-0x0000000000000000-mapping.dmp
-
memory/1052-84-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1052-86-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1052-85-0x000000000040B000-mapping.dmp
-
memory/1256-71-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-81-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-83-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-82-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-80-0x0000000000668000-0x0000000000669000-memory.dmpFilesize
4KB
-
memory/1256-79-0x0000000000668000-0x0000000000669000-memory.dmpFilesize
4KB
-
memory/1256-78-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-77-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-76-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-75-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-72-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-70-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-69-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-66-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-65-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-64-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-51-0x0000000000000000-mapping.dmp
-
memory/1256-63-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-62-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-61-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-60-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-55-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-56-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-57-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-58-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1256-59-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1472-43-0x0000000000000000-mapping.dmp
-
memory/1584-89-0x00000000004085D0-mapping.dmp
-
memory/1760-102-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1760-101-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1760-97-0x00000000004B5210-mapping.dmp
-
memory/1760-96-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1808-2-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-28-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-11-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-6-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-9-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-7-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-4-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-3-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-19-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-27-0x00000000006D8000-0x00000000006D9000-memory.dmpFilesize
4KB
-
memory/1808-26-0x00000000006D8000-0x00000000006D9000-memory.dmpFilesize
4KB
-
memory/1808-29-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-30-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-10-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-22-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-23-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-12-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-24-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-25-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-8-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-13-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-16-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-5-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-17-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB
-
memory/1808-18-0x00000000006D6000-0x00000000006D7000-memory.dmpFilesize
4KB