Analysis
-
max time kernel
14s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe
Resource
win7v20201028
General
-
Target
ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe
-
Size
1.5MB
-
MD5
10cd65c7d98b8802516694b7a4976ea2
-
SHA1
7917aa791dd23376d69fbdadea5ec13fac90bf19
-
SHA256
ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16
-
SHA512
906310440bbf6edccfdd07b862f6c1ded01dc744590621cb67788217c2834b48cae749e700aabadcda29dbc3d98553d71eaf457d804444559974820058266574
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 3208 ichader.exe 2560 ichader.exe 3888 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/1752-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1752-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1752-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3888-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3888-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3888-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exeichader.exedescription pid process target process PID 984 set thread context of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 set thread context of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 3208 set thread context of 3488 3208 ichader.exe svchost.exe PID 3208 set thread context of 2560 3208 ichader.exe ichader.exe PID 3208 set thread context of 3888 3208 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe 780 svchost.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 3888 ichader.exe Token: SeSecurityPrivilege 3888 ichader.exe Token: SeTakeOwnershipPrivilege 3888 ichader.exe Token: SeLoadDriverPrivilege 3888 ichader.exe Token: SeSystemProfilePrivilege 3888 ichader.exe Token: SeSystemtimePrivilege 3888 ichader.exe Token: SeProfSingleProcessPrivilege 3888 ichader.exe Token: SeIncBasePriorityPrivilege 3888 ichader.exe Token: SeCreatePagefilePrivilege 3888 ichader.exe Token: SeBackupPrivilege 3888 ichader.exe Token: SeRestorePrivilege 3888 ichader.exe Token: SeShutdownPrivilege 3888 ichader.exe Token: SeDebugPrivilege 3888 ichader.exe Token: SeSystemEnvironmentPrivilege 3888 ichader.exe Token: SeChangeNotifyPrivilege 3888 ichader.exe Token: SeRemoteShutdownPrivilege 3888 ichader.exe Token: SeUndockPrivilege 3888 ichader.exe Token: SeManageVolumePrivilege 3888 ichader.exe Token: SeImpersonatePrivilege 3888 ichader.exe Token: SeCreateGlobalPrivilege 3888 ichader.exe Token: 33 3888 ichader.exe Token: 34 3888 ichader.exe Token: 35 3888 ichader.exe Token: 36 3888 ichader.exe Token: SeDebugPrivilege 2560 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exesvchost.exeac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exeichader.exesvchost.exeichader.exeichader.exepid process 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe 780 svchost.exe 1752 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe 3208 ichader.exe 3488 svchost.exe 2560 ichader.exe 3888 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exeac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.execmd.exeichader.exedescription pid process target process PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 780 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe svchost.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 984 wrote to memory of 1752 984 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe PID 1752 wrote to memory of 3640 1752 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe cmd.exe PID 1752 wrote to memory of 3640 1752 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe cmd.exe PID 1752 wrote to memory of 3640 1752 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe cmd.exe PID 3640 wrote to memory of 188 3640 cmd.exe reg.exe PID 3640 wrote to memory of 188 3640 cmd.exe reg.exe PID 3640 wrote to memory of 188 3640 cmd.exe reg.exe PID 1752 wrote to memory of 3208 1752 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ichader.exe PID 1752 wrote to memory of 3208 1752 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ichader.exe PID 1752 wrote to memory of 3208 1752 ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe ichader.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 3488 3208 ichader.exe svchost.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 2560 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe PID 3208 wrote to memory of 3888 3208 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe"C:\Users\Admin\AppData\Local\Temp\ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:780 -
C:\Users\Admin\AppData\Local\Temp\ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe"C:\Users\Admin\AppData\Local\Temp\ac3fdb218275ff7609fbca0c02925cc44bfe72ef3a56065f5aa127d74c19bd16.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KQVHF.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:188 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:3488 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2560 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\KQVHF.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
e533ceee40191cb811082eb7fc920fbd
SHA10dea0a528e11a83d578eb1d59b7366e882b5998a
SHA256f2e62c3cfcb3f32072760949eb72c1eb63bec20d5a5c80e04c693be2f0d111dd
SHA51202b9e99cfc82ed69ed0173606b650b9aaeffb369e0c5203fa1972f4ec9f0a311dd4ccc9f01243594ab56df988992a860f2c2503efd2160d4fb681c06a214166a
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
e533ceee40191cb811082eb7fc920fbd
SHA10dea0a528e11a83d578eb1d59b7366e882b5998a
SHA256f2e62c3cfcb3f32072760949eb72c1eb63bec20d5a5c80e04c693be2f0d111dd
SHA51202b9e99cfc82ed69ed0173606b650b9aaeffb369e0c5203fa1972f4ec9f0a311dd4ccc9f01243594ab56df988992a860f2c2503efd2160d4fb681c06a214166a
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
e533ceee40191cb811082eb7fc920fbd
SHA10dea0a528e11a83d578eb1d59b7366e882b5998a
SHA256f2e62c3cfcb3f32072760949eb72c1eb63bec20d5a5c80e04c693be2f0d111dd
SHA51202b9e99cfc82ed69ed0173606b650b9aaeffb369e0c5203fa1972f4ec9f0a311dd4ccc9f01243594ab56df988992a860f2c2503efd2160d4fb681c06a214166a
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
e533ceee40191cb811082eb7fc920fbd
SHA10dea0a528e11a83d578eb1d59b7366e882b5998a
SHA256f2e62c3cfcb3f32072760949eb72c1eb63bec20d5a5c80e04c693be2f0d111dd
SHA51202b9e99cfc82ed69ed0173606b650b9aaeffb369e0c5203fa1972f4ec9f0a311dd4ccc9f01243594ab56df988992a860f2c2503efd2160d4fb681c06a214166a
-
memory/188-16-0x0000000000000000-mapping.dmp
-
memory/780-3-0x000000000040B000-mapping.dmp
-
memory/780-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/780-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/780-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1752-8-0x00000000004085D0-mapping.dmp
-
memory/1752-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1752-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1752-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2560-32-0x0000000073350000-0x00000000733E3000-memory.dmpFilesize
588KB
-
memory/2560-30-0x00000000004085D0-mapping.dmp
-
memory/3208-20-0x0000000073350000-0x00000000733E3000-memory.dmpFilesize
588KB
-
memory/3208-17-0x0000000000000000-mapping.dmp
-
memory/3488-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3488-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3488-24-0x000000000040B000-mapping.dmp
-
memory/3640-14-0x0000000000000000-mapping.dmp
-
memory/3888-33-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3888-35-0x00000000004B5210-mapping.dmp
-
memory/3888-38-0x0000000073350000-0x00000000733E3000-memory.dmpFilesize
588KB
-
memory/3888-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3888-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB