Analysis
-
max time kernel
24s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:50
Static task
static1
Behavioral task
behavioral1
Sample
21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe
Resource
win7v20201028
General
-
Target
21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe
-
Size
1.5MB
-
MD5
a0dc02d95386e0fd2b6109256080f35e
-
SHA1
c46dbb23b24806d90cc7a564be0fd6062176cf67
-
SHA256
21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e
-
SHA512
525d4287c27533bc53319507a1a4f4cd883d6f4db7b97339e6e26ed54e4fb504e4406aaab116980be608ac65a57fc065bf17c9cfe823443f20c25ac9a09c1c15
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 2388 ichader.exe 3648 ichader.exe 2204 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/1904-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1904-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1904-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2204-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2204-40-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2204-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exeichader.exedescription pid process target process PID 636 set thread context of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 set thread context of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 2388 set thread context of 632 2388 ichader.exe svchost.exe PID 2388 set thread context of 3648 2388 ichader.exe ichader.exe PID 2388 set thread context of 2204 2388 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 2204 ichader.exe Token: SeSecurityPrivilege 2204 ichader.exe Token: SeTakeOwnershipPrivilege 2204 ichader.exe Token: SeLoadDriverPrivilege 2204 ichader.exe Token: SeSystemProfilePrivilege 2204 ichader.exe Token: SeSystemtimePrivilege 2204 ichader.exe Token: SeProfSingleProcessPrivilege 2204 ichader.exe Token: SeIncBasePriorityPrivilege 2204 ichader.exe Token: SeCreatePagefilePrivilege 2204 ichader.exe Token: SeBackupPrivilege 2204 ichader.exe Token: SeRestorePrivilege 2204 ichader.exe Token: SeShutdownPrivilege 2204 ichader.exe Token: SeDebugPrivilege 2204 ichader.exe Token: SeSystemEnvironmentPrivilege 2204 ichader.exe Token: SeChangeNotifyPrivilege 2204 ichader.exe Token: SeRemoteShutdownPrivilege 2204 ichader.exe Token: SeUndockPrivilege 2204 ichader.exe Token: SeManageVolumePrivilege 2204 ichader.exe Token: SeImpersonatePrivilege 2204 ichader.exe Token: SeCreateGlobalPrivilege 2204 ichader.exe Token: 33 2204 ichader.exe Token: 34 2204 ichader.exe Token: 35 2204 ichader.exe Token: 36 2204 ichader.exe Token: SeDebugPrivilege 3648 ichader.exe Token: SeDebugPrivilege 3648 ichader.exe Token: SeDebugPrivilege 3648 ichader.exe Token: SeDebugPrivilege 3648 ichader.exe Token: SeDebugPrivilege 3648 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exesvchost.exe21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exeichader.exesvchost.exeichader.exeichader.exepid process 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 3984 svchost.exe 1904 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 2388 ichader.exe 632 svchost.exe 3648 ichader.exe 2204 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.execmd.exeichader.exedescription pid process target process PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 3984 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe svchost.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 636 wrote to memory of 1904 636 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe PID 1904 wrote to memory of 3664 1904 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe cmd.exe PID 1904 wrote to memory of 3664 1904 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe cmd.exe PID 1904 wrote to memory of 3664 1904 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe cmd.exe PID 3664 wrote to memory of 4044 3664 cmd.exe reg.exe PID 3664 wrote to memory of 4044 3664 cmd.exe reg.exe PID 3664 wrote to memory of 4044 3664 cmd.exe reg.exe PID 1904 wrote to memory of 2388 1904 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe ichader.exe PID 1904 wrote to memory of 2388 1904 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe ichader.exe PID 1904 wrote to memory of 2388 1904 21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe ichader.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 632 2388 ichader.exe svchost.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 3648 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe PID 2388 wrote to memory of 2204 2388 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe"C:\Users\Admin\AppData\Local\Temp\21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe"C:\Users\Admin\AppData\Local\Temp\21c8760522b1c8d9406627f89e450429589d7b427820ab99c8b144f5d2d4e36e.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HJWXF.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HJWXF.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
c777777c4fb5e155dc335259f9f61f10
SHA11bdb6c80856df64321a2c9b403e7cebe740b55c1
SHA2561dc0eb75a797e0d410c88fa191aa6319fd541b76a8ff0085539e92d6f14a0402
SHA51281f297fd387f7342c8904572c02938338e49e1662e436ac48c6ac8cd5b69832eaf034d97cbd3817e07348a1b657906ba56399ae35fb8bc9092a1d2c3c9cc7916
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
c777777c4fb5e155dc335259f9f61f10
SHA11bdb6c80856df64321a2c9b403e7cebe740b55c1
SHA2561dc0eb75a797e0d410c88fa191aa6319fd541b76a8ff0085539e92d6f14a0402
SHA51281f297fd387f7342c8904572c02938338e49e1662e436ac48c6ac8cd5b69832eaf034d97cbd3817e07348a1b657906ba56399ae35fb8bc9092a1d2c3c9cc7916
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
c777777c4fb5e155dc335259f9f61f10
SHA11bdb6c80856df64321a2c9b403e7cebe740b55c1
SHA2561dc0eb75a797e0d410c88fa191aa6319fd541b76a8ff0085539e92d6f14a0402
SHA51281f297fd387f7342c8904572c02938338e49e1662e436ac48c6ac8cd5b69832eaf034d97cbd3817e07348a1b657906ba56399ae35fb8bc9092a1d2c3c9cc7916
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
c777777c4fb5e155dc335259f9f61f10
SHA11bdb6c80856df64321a2c9b403e7cebe740b55c1
SHA2561dc0eb75a797e0d410c88fa191aa6319fd541b76a8ff0085539e92d6f14a0402
SHA51281f297fd387f7342c8904572c02938338e49e1662e436ac48c6ac8cd5b69832eaf034d97cbd3817e07348a1b657906ba56399ae35fb8bc9092a1d2c3c9cc7916
-
memory/632-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/632-24-0x000000000040B000-mapping.dmp
-
memory/632-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1904-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1904-8-0x00000000004085D0-mapping.dmp
-
memory/1904-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1904-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2204-36-0x00000000004B5210-mapping.dmp
-
memory/2204-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2204-40-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2204-34-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2204-38-0x0000000073910000-0x00000000739A3000-memory.dmpFilesize
588KB
-
memory/2388-17-0x0000000000000000-mapping.dmp
-
memory/2388-20-0x0000000073910000-0x00000000739A3000-memory.dmpFilesize
588KB
-
memory/3648-30-0x00000000004085D0-mapping.dmp
-
memory/3648-32-0x0000000073910000-0x00000000739A3000-memory.dmpFilesize
588KB
-
memory/3664-14-0x0000000000000000-mapping.dmp
-
memory/3984-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3984-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3984-3-0x000000000040B000-mapping.dmp
-
memory/3984-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4044-16-0x0000000000000000-mapping.dmp