Analysis
-
max time kernel
16s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe
Resource
win7v20201028
General
-
Target
daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe
-
Size
1.5MB
-
MD5
2b7f5490fba863e91bfa7d1043eaeebe
-
SHA1
e96c7b3494f178e82085f0ea8c093e3aaf61eb11
-
SHA256
daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1
-
SHA512
16a5e3224372a54363f84576ebd7abfef5196d89be2bb5f3afe326d6d85ab665c899cd64656ad6858ed2fc69c95f4ed377776a937cae10f9cd29e64a30833692
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3492 ichader.exe 816 ichader.exe 3876 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/2928-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2928-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2928-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3876-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3876-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3876-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exeichader.exedescription pid process target process PID 1048 set thread context of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 set thread context of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 3492 set thread context of 2132 3492 ichader.exe svchost.exe PID 3492 set thread context of 816 3492 ichader.exe ichader.exe PID 3492 set thread context of 3876 3492 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 3876 ichader.exe Token: SeSecurityPrivilege 3876 ichader.exe Token: SeTakeOwnershipPrivilege 3876 ichader.exe Token: SeLoadDriverPrivilege 3876 ichader.exe Token: SeSystemProfilePrivilege 3876 ichader.exe Token: SeSystemtimePrivilege 3876 ichader.exe Token: SeProfSingleProcessPrivilege 3876 ichader.exe Token: SeIncBasePriorityPrivilege 3876 ichader.exe Token: SeCreatePagefilePrivilege 3876 ichader.exe Token: SeBackupPrivilege 3876 ichader.exe Token: SeRestorePrivilege 3876 ichader.exe Token: SeShutdownPrivilege 3876 ichader.exe Token: SeDebugPrivilege 3876 ichader.exe Token: SeSystemEnvironmentPrivilege 3876 ichader.exe Token: SeChangeNotifyPrivilege 3876 ichader.exe Token: SeRemoteShutdownPrivilege 3876 ichader.exe Token: SeUndockPrivilege 3876 ichader.exe Token: SeManageVolumePrivilege 3876 ichader.exe Token: SeImpersonatePrivilege 3876 ichader.exe Token: SeCreateGlobalPrivilege 3876 ichader.exe Token: 33 3876 ichader.exe Token: 34 3876 ichader.exe Token: 35 3876 ichader.exe Token: 36 3876 ichader.exe Token: SeDebugPrivilege 816 ichader.exe Token: SeDebugPrivilege 816 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exesvchost.exedaf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exeichader.exesvchost.exeichader.exeichader.exepid process 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe 1012 svchost.exe 2928 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe 3492 ichader.exe 2132 svchost.exe 816 ichader.exe 3876 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exedaf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.execmd.exeichader.exedescription pid process target process PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 1012 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe svchost.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 1048 wrote to memory of 2928 1048 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe PID 2928 wrote to memory of 3628 2928 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe cmd.exe PID 2928 wrote to memory of 3628 2928 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe cmd.exe PID 2928 wrote to memory of 3628 2928 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe cmd.exe PID 3628 wrote to memory of 3836 3628 cmd.exe reg.exe PID 3628 wrote to memory of 3836 3628 cmd.exe reg.exe PID 3628 wrote to memory of 3836 3628 cmd.exe reg.exe PID 2928 wrote to memory of 3492 2928 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe ichader.exe PID 2928 wrote to memory of 3492 2928 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe ichader.exe PID 2928 wrote to memory of 3492 2928 daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe ichader.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 2132 3492 ichader.exe svchost.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 816 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe PID 3492 wrote to memory of 3876 3492 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe"C:\Users\Admin\AppData\Local\Temp\daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe"C:\Users\Admin\AppData\Local\Temp\daf9795cb3eb8ebf7ff2f451060b13f100de27119dc144e65edc290ec535e5d1.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HYUVI.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HYUVI.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
01b9131066edc86ee2eed6bab3a73d18
SHA1e090a7519188681d025999d067ad17ff668e6638
SHA2567874571b39102151d42ecab3d6fa7ee3a09ae7a24bfd398e3e04552b4599db7c
SHA512767c433299fe507520136acee27f7f2005d9023eea0fb52277acb8c78a39a54626644b802040d49e2d130aed65164d11924a59242916cb71bb3caa5c0762f7cb
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
01b9131066edc86ee2eed6bab3a73d18
SHA1e090a7519188681d025999d067ad17ff668e6638
SHA2567874571b39102151d42ecab3d6fa7ee3a09ae7a24bfd398e3e04552b4599db7c
SHA512767c433299fe507520136acee27f7f2005d9023eea0fb52277acb8c78a39a54626644b802040d49e2d130aed65164d11924a59242916cb71bb3caa5c0762f7cb
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
01b9131066edc86ee2eed6bab3a73d18
SHA1e090a7519188681d025999d067ad17ff668e6638
SHA2567874571b39102151d42ecab3d6fa7ee3a09ae7a24bfd398e3e04552b4599db7c
SHA512767c433299fe507520136acee27f7f2005d9023eea0fb52277acb8c78a39a54626644b802040d49e2d130aed65164d11924a59242916cb71bb3caa5c0762f7cb
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
01b9131066edc86ee2eed6bab3a73d18
SHA1e090a7519188681d025999d067ad17ff668e6638
SHA2567874571b39102151d42ecab3d6fa7ee3a09ae7a24bfd398e3e04552b4599db7c
SHA512767c433299fe507520136acee27f7f2005d9023eea0fb52277acb8c78a39a54626644b802040d49e2d130aed65164d11924a59242916cb71bb3caa5c0762f7cb
-
memory/816-32-0x00000000736F0000-0x0000000073783000-memory.dmpFilesize
588KB
-
memory/816-30-0x00000000004085D0-mapping.dmp
-
memory/1012-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1012-3-0x000000000040B000-mapping.dmp
-
memory/1012-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1012-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2132-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2132-24-0x000000000040B000-mapping.dmp
-
memory/2132-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2928-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2928-8-0x00000000004085D0-mapping.dmp
-
memory/2928-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2928-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3492-17-0x0000000000000000-mapping.dmp
-
memory/3492-20-0x00000000736F0000-0x0000000073783000-memory.dmpFilesize
588KB
-
memory/3628-14-0x0000000000000000-mapping.dmp
-
memory/3836-16-0x0000000000000000-mapping.dmp
-
memory/3876-34-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3876-38-0x00000000736F0000-0x0000000073783000-memory.dmpFilesize
588KB
-
memory/3876-36-0x00000000004B5210-mapping.dmp
-
memory/3876-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3876-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB