Analysis
-
max time kernel
41s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe
Resource
win7v20201028
General
-
Target
1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe
-
Size
1.5MB
-
MD5
4bb315fbc47de30e0bb3f0f3551b4970
-
SHA1
b60c0cc43d6255b70217875acff1ab7f7732a71f
-
SHA256
1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362
-
SHA512
cd16b6d52da9863f50432019c2028c5c1ea73cb1f3ec5f6e0a30a54af32aced27ef6c40395edc72ed69cbada85527eb81da09465cf427344566de80f6ac42fa9
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3336 ichader.exe 3892 ichader.exe 2468 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/1096-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1096-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2468-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exeichader.exedescription pid process target process PID 948 set thread context of 1932 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe svchost.exe PID 948 set thread context of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 3336 set thread context of 808 3336 ichader.exe svchost.exe PID 3336 set thread context of 3892 3336 ichader.exe ichader.exe PID 3336 set thread context of 2468 3336 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 192 1932 WerFault.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 2468 ichader.exe Token: SeSecurityPrivilege 2468 ichader.exe Token: SeTakeOwnershipPrivilege 2468 ichader.exe Token: SeLoadDriverPrivilege 2468 ichader.exe Token: SeSystemProfilePrivilege 2468 ichader.exe Token: SeSystemtimePrivilege 2468 ichader.exe Token: SeProfSingleProcessPrivilege 2468 ichader.exe Token: SeIncBasePriorityPrivilege 2468 ichader.exe Token: SeCreatePagefilePrivilege 2468 ichader.exe Token: SeBackupPrivilege 2468 ichader.exe Token: SeRestorePrivilege 2468 ichader.exe Token: SeShutdownPrivilege 2468 ichader.exe Token: SeDebugPrivilege 2468 ichader.exe Token: SeSystemEnvironmentPrivilege 2468 ichader.exe Token: SeChangeNotifyPrivilege 2468 ichader.exe Token: SeRemoteShutdownPrivilege 2468 ichader.exe Token: SeUndockPrivilege 2468 ichader.exe Token: SeManageVolumePrivilege 2468 ichader.exe Token: SeImpersonatePrivilege 2468 ichader.exe Token: SeCreateGlobalPrivilege 2468 ichader.exe Token: 33 2468 ichader.exe Token: 34 2468 ichader.exe Token: 35 2468 ichader.exe Token: 36 2468 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe Token: SeDebugPrivilege 3892 ichader.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exeichader.exesvchost.exeichader.exeichader.exepid process 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1096 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 3336 ichader.exe 808 svchost.exe 3892 ichader.exe 2468 ichader.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.execmd.exeichader.exedescription pid process target process PID 948 wrote to memory of 1932 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe svchost.exe PID 948 wrote to memory of 1932 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe svchost.exe PID 948 wrote to memory of 1932 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe svchost.exe PID 948 wrote to memory of 1932 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe svchost.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 948 wrote to memory of 1096 948 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe PID 1096 wrote to memory of 772 1096 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe cmd.exe PID 1096 wrote to memory of 772 1096 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe cmd.exe PID 1096 wrote to memory of 772 1096 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe cmd.exe PID 772 wrote to memory of 1520 772 cmd.exe reg.exe PID 772 wrote to memory of 1520 772 cmd.exe reg.exe PID 772 wrote to memory of 1520 772 cmd.exe reg.exe PID 1096 wrote to memory of 3336 1096 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe ichader.exe PID 1096 wrote to memory of 3336 1096 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe ichader.exe PID 1096 wrote to memory of 3336 1096 1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe ichader.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 808 3336 ichader.exe svchost.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 3892 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe PID 3336 wrote to memory of 2468 3336 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe"C:\Users\Admin\AppData\Local\Temp\1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 923⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe"C:\Users\Admin\AppData\Local\Temp\1cc3c44cb2987e697a2c4e3f2b48dfe5555b774dc86efcb06d15f64a9ab14362.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ADTPQ.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ADTPQ.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
8ed393167cb4a1d029b1d24acff42a7c
SHA16ba670807f08941cc8df0d5e7dac8935a9779fb4
SHA256645e6780fe75371c753a4c99cc7a92fe9d39130b6ed43f75a95b73ad3660a6c1
SHA512ba25af7b3f9fe3f1a9f23452b843b9ba23c36346896b7c388292640e50927fed9b841fad49f94a7c151bb2f6aa360e79f8135060af9161fa3a9d70db7b0415f7
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
8ed393167cb4a1d029b1d24acff42a7c
SHA16ba670807f08941cc8df0d5e7dac8935a9779fb4
SHA256645e6780fe75371c753a4c99cc7a92fe9d39130b6ed43f75a95b73ad3660a6c1
SHA512ba25af7b3f9fe3f1a9f23452b843b9ba23c36346896b7c388292640e50927fed9b841fad49f94a7c151bb2f6aa360e79f8135060af9161fa3a9d70db7b0415f7
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
8ed393167cb4a1d029b1d24acff42a7c
SHA16ba670807f08941cc8df0d5e7dac8935a9779fb4
SHA256645e6780fe75371c753a4c99cc7a92fe9d39130b6ed43f75a95b73ad3660a6c1
SHA512ba25af7b3f9fe3f1a9f23452b843b9ba23c36346896b7c388292640e50927fed9b841fad49f94a7c151bb2f6aa360e79f8135060af9161fa3a9d70db7b0415f7
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
-
memory/192-10-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/772-11-0x0000000000000000-mapping.dmp
-
memory/808-20-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/808-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/808-22-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/808-21-0x000000000040B000-mapping.dmp
-
memory/1096-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1096-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1096-5-0x00000000004085D0-mapping.dmp
-
memory/1096-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1520-13-0x0000000000000000-mapping.dmp
-
memory/1932-3-0x000000000040B000-mapping.dmp
-
memory/2468-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2468-35-0x0000000073570000-0x0000000073603000-memory.dmpFilesize
588KB
-
memory/2468-38-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2468-30-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2468-31-0x00000000004B5210-mapping.dmp
-
memory/3336-17-0x0000000073570000-0x0000000073603000-memory.dmpFilesize
588KB
-
memory/3336-14-0x0000000000000000-mapping.dmp
-
memory/3892-29-0x0000000073570000-0x0000000073603000-memory.dmpFilesize
588KB
-
memory/3892-27-0x00000000004085D0-mapping.dmp