Analysis
-
max time kernel
8s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:50
Static task
static1
Behavioral task
behavioral1
Sample
2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe
Resource
win7v20201028
General
-
Target
2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe
-
Size
1.5MB
-
MD5
a3067176161213b6efe72cdbf37f374e
-
SHA1
66e2c3a6ce89d96691349178700ba67f7fd3f453
-
SHA256
2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003
-
SHA512
f76d8105fb85dd7ceb4e3c1381fc137c38d2cfefaf9181a3c2465a936ae9548c6b735c3ee16fd092e63bddf5257a69c3718d0086503daacb7e18ef2d67374086
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3308 ichader.exe 3244 ichader.exe 4280 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3400-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3400-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3400-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4280-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4280-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4280-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exeichader.exedescription pid process target process PID 4644 set thread context of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 set thread context of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 3308 set thread context of 3248 3308 ichader.exe svchost.exe PID 3308 set thread context of 3244 3308 ichader.exe ichader.exe PID 3308 set thread context of 4280 3308 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe 3432 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 4280 ichader.exe Token: SeSecurityPrivilege 4280 ichader.exe Token: SeTakeOwnershipPrivilege 4280 ichader.exe Token: SeLoadDriverPrivilege 4280 ichader.exe Token: SeSystemProfilePrivilege 4280 ichader.exe Token: SeSystemtimePrivilege 4280 ichader.exe Token: SeProfSingleProcessPrivilege 4280 ichader.exe Token: SeIncBasePriorityPrivilege 4280 ichader.exe Token: SeCreatePagefilePrivilege 4280 ichader.exe Token: SeBackupPrivilege 4280 ichader.exe Token: SeRestorePrivilege 4280 ichader.exe Token: SeShutdownPrivilege 4280 ichader.exe Token: SeDebugPrivilege 4280 ichader.exe Token: SeSystemEnvironmentPrivilege 4280 ichader.exe Token: SeChangeNotifyPrivilege 4280 ichader.exe Token: SeRemoteShutdownPrivilege 4280 ichader.exe Token: SeUndockPrivilege 4280 ichader.exe Token: SeManageVolumePrivilege 4280 ichader.exe Token: SeImpersonatePrivilege 4280 ichader.exe Token: SeCreateGlobalPrivilege 4280 ichader.exe Token: 33 4280 ichader.exe Token: 34 4280 ichader.exe Token: 35 4280 ichader.exe Token: 36 4280 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exesvchost.exe2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exeichader.exesvchost.exeichader.exeichader.exepid process 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 3432 svchost.exe 3400 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 3308 ichader.exe 3248 svchost.exe 3244 ichader.exe 4280 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.execmd.exeichader.exedescription pid process target process PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3432 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe svchost.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 4644 wrote to memory of 3400 4644 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe PID 3400 wrote to memory of 756 3400 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe cmd.exe PID 3400 wrote to memory of 756 3400 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe cmd.exe PID 3400 wrote to memory of 756 3400 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe cmd.exe PID 756 wrote to memory of 3164 756 cmd.exe reg.exe PID 756 wrote to memory of 3164 756 cmd.exe reg.exe PID 756 wrote to memory of 3164 756 cmd.exe reg.exe PID 3400 wrote to memory of 3308 3400 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe ichader.exe PID 3400 wrote to memory of 3308 3400 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe ichader.exe PID 3400 wrote to memory of 3308 3400 2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe ichader.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3248 3308 ichader.exe svchost.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 3244 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe PID 3308 wrote to memory of 4280 3308 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe"C:\Users\Admin\AppData\Local\Temp\2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe"C:\Users\Admin\AppData\Local\Temp\2e12e3f3ff72d103fb2314be622cb85d3dc824ea8b74eb2b5df9be7035354003.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SGJFD.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:3164 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:3248 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3244 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SGJFD.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0157b9cfd548ff8173d8cdcbba874d6c
SHA1671f5357b4e5493f09f0fa7232722e903d970e9f
SHA256f4f5d02866962b2f212af3607526bf450844672f5abed857e79a192c1bae5b61
SHA512159d38a71b0b29c69714afe63f011cd0b8498632bc1df49c6d9fa22961a19b3a7277b5f902393ad0faadc635905fae0ac09579ac3d43d8353c15817551d40ff2
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0157b9cfd548ff8173d8cdcbba874d6c
SHA1671f5357b4e5493f09f0fa7232722e903d970e9f
SHA256f4f5d02866962b2f212af3607526bf450844672f5abed857e79a192c1bae5b61
SHA512159d38a71b0b29c69714afe63f011cd0b8498632bc1df49c6d9fa22961a19b3a7277b5f902393ad0faadc635905fae0ac09579ac3d43d8353c15817551d40ff2
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0157b9cfd548ff8173d8cdcbba874d6c
SHA1671f5357b4e5493f09f0fa7232722e903d970e9f
SHA256f4f5d02866962b2f212af3607526bf450844672f5abed857e79a192c1bae5b61
SHA512159d38a71b0b29c69714afe63f011cd0b8498632bc1df49c6d9fa22961a19b3a7277b5f902393ad0faadc635905fae0ac09579ac3d43d8353c15817551d40ff2
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0157b9cfd548ff8173d8cdcbba874d6c
SHA1671f5357b4e5493f09f0fa7232722e903d970e9f
SHA256f4f5d02866962b2f212af3607526bf450844672f5abed857e79a192c1bae5b61
SHA512159d38a71b0b29c69714afe63f011cd0b8498632bc1df49c6d9fa22961a19b3a7277b5f902393ad0faadc635905fae0ac09579ac3d43d8353c15817551d40ff2
-
memory/756-14-0x0000000000000000-mapping.dmp
-
memory/3164-16-0x0000000000000000-mapping.dmp
-
memory/3244-32-0x0000000073940000-0x00000000739D3000-memory.dmpFilesize
588KB
-
memory/3244-29-0x00000000004085D0-mapping.dmp
-
memory/3248-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3248-24-0x000000000040B000-mapping.dmp
-
memory/3248-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3308-20-0x0000000073940000-0x00000000739D3000-memory.dmpFilesize
588KB
-
memory/3308-17-0x0000000000000000-mapping.dmp
-
memory/3400-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3400-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3400-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3400-8-0x00000000004085D0-mapping.dmp
-
memory/3432-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3432-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3432-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3432-3-0x000000000040B000-mapping.dmp
-
memory/4280-33-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4280-38-0x0000000073940000-0x00000000739D3000-memory.dmpFilesize
588KB
-
memory/4280-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4280-35-0x00000000004B5210-mapping.dmp
-
memory/4280-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB