Analysis
- max time kernel
120s - max time network
156s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe
- Size 1.5MB
- Sample201109-pvvy6vpvae
- SHA256 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d
- MD5 a8d87f85abebd106b6c3fc3a340931c5
- SHA1 b35b4b1c4a9c4729f021a1c7fbdeb1909eb5d84d
- SHA512 7d3b846b3481f31072c198e90c80f8957a4dd67834a125da12e21198bc58823e0da5e5114404c783bd7cae642ee31c187571fa1a1c337633219a91d249aade01
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Runescape
C2
-
mrsnickers03.no-ip.biz:340
Mutex
-
DC_MUTEX-6ZFK11A
Attributes
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Executes dropped EXE 3 IoCs
pid Process 996 ichader.exe 1588 ichader.exe 1784 ichader.exe -
resource yara_rule behavioral2/memory/4084-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4084-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4084-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1784-30-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1784-38-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1784-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe - Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4684 set thread context of 416 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 75 PID 4684 set thread context of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 996 set thread context of 1412 996 ichader.exe 86 PID 996 set thread context of 1588 996 ichader.exe 87 PID 996 set thread context of 1784 996 ichader.exe 88 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3180 416 WerFault.exe 75 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe 1412 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1784 ichader.exe Token: SeSecurityPrivilege 1784 ichader.exe Token: SeTakeOwnershipPrivilege 1784 ichader.exe Token: SeLoadDriverPrivilege 1784 ichader.exe Token: SeSystemProfilePrivilege 1784 ichader.exe Token: SeSystemtimePrivilege 1784 ichader.exe Token: SeProfSingleProcessPrivilege 1784 ichader.exe Token: SeIncBasePriorityPrivilege 1784 ichader.exe Token: SeCreatePagefilePrivilege 1784 ichader.exe Token: SeBackupPrivilege 1784 ichader.exe Token: SeRestorePrivilege 1784 ichader.exe Token: SeShutdownPrivilege 1784 ichader.exe Token: SeDebugPrivilege 1784 ichader.exe Token: SeSystemEnvironmentPrivilege 1784 ichader.exe Token: SeChangeNotifyPrivilege 1784 ichader.exe Token: SeRemoteShutdownPrivilege 1784 ichader.exe Token: SeUndockPrivilege 1784 ichader.exe Token: SeManageVolumePrivilege 1784 ichader.exe Token: SeImpersonatePrivilege 1784 ichader.exe Token: SeCreateGlobalPrivilege 1784 ichader.exe Token: 33 1784 ichader.exe Token: 34 1784 ichader.exe Token: 35 1784 ichader.exe Token: 36 1784 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe Token: SeDebugPrivilege 1588 ichader.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 4084 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 996 ichader.exe 1412 svchost.exe 1588 ichader.exe 1784 ichader.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4684 wrote to memory of 416 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 75 PID 4684 wrote to memory of 416 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 75 PID 4684 wrote to memory of 416 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 75 PID 4684 wrote to memory of 416 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 75 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4684 wrote to memory of 4084 4684 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 77 PID 4084 wrote to memory of 4064 4084 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 79 PID 4084 wrote to memory of 4064 4084 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 79 PID 4084 wrote to memory of 4064 4084 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 79 PID 4064 wrote to memory of 792 4064 cmd.exe 82 PID 4064 wrote to memory of 792 4064 cmd.exe 82 PID 4064 wrote to memory of 792 4064 cmd.exe 82 PID 4084 wrote to memory of 996 4084 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 83 PID 4084 wrote to memory of 996 4084 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 83 PID 4084 wrote to memory of 996 4084 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe 83 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1412 996 ichader.exe 86 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1588 996 ichader.exe 87 PID 996 wrote to memory of 1784 996 ichader.exe 88 PID 996 wrote to memory of 1784 996 ichader.exe 88 PID 996 wrote to memory of 1784 996 ichader.exe 88 PID 996 wrote to memory of 1784 996 ichader.exe 88 PID 996 wrote to memory of 1784 996 ichader.exe 88 PID 996 wrote to memory of 1784 996 ichader.exe 88 PID 996 wrote to memory of 1784 996 ichader.exe 88 PID 996 wrote to memory of 1784 996 ichader.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe"C:\Users\Admin\AppData\Local\Temp\3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵PID:416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 923⤵
- Program crash
PID:3180
-
-
-
C:\Users\Admin\AppData\Local\Temp\3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe"C:\Users\Admin\AppData\Local\Temp\3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IWVHP.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:792
-
-
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1588
-
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
-