Analysis
-
max time kernel
12s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:44
Static task
static1
Behavioral task
behavioral1
Sample
cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe
Resource
win7v20201028
General
-
Target
cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe
-
Size
1.5MB
-
MD5
21115a6c4354979616026ba53b079066
-
SHA1
4ced6a79cd095fc1f128a3053cd1d29cb8e81996
-
SHA256
cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7
-
SHA512
0bc8fb29658c5dc8f490e881ab5dde096585436ca4465c712d4ca7b351ff29fe354f464bca7734c36819bcd04073863c4bd56db9eb539761ca7b2930df9f54f2
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 2120 ichader.exe 4080 ichader.exe 3488 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/3700-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3700-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3700-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3488-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3488-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3488-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exeichader.exedescription pid process target process PID 656 set thread context of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 set thread context of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 2120 set thread context of 2336 2120 ichader.exe svchost.exe PID 2120 set thread context of 4080 2120 ichader.exe ichader.exe PID 2120 set thread context of 3488 2120 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
ichader.exeichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 3488 ichader.exe Token: SeSecurityPrivilege 3488 ichader.exe Token: SeTakeOwnershipPrivilege 3488 ichader.exe Token: SeLoadDriverPrivilege 3488 ichader.exe Token: SeSystemProfilePrivilege 3488 ichader.exe Token: SeSystemtimePrivilege 3488 ichader.exe Token: SeProfSingleProcessPrivilege 3488 ichader.exe Token: SeIncBasePriorityPrivilege 3488 ichader.exe Token: SeCreatePagefilePrivilege 3488 ichader.exe Token: SeBackupPrivilege 3488 ichader.exe Token: SeRestorePrivilege 3488 ichader.exe Token: SeShutdownPrivilege 3488 ichader.exe Token: SeDebugPrivilege 3488 ichader.exe Token: SeSystemEnvironmentPrivilege 3488 ichader.exe Token: SeChangeNotifyPrivilege 3488 ichader.exe Token: SeRemoteShutdownPrivilege 3488 ichader.exe Token: SeUndockPrivilege 3488 ichader.exe Token: SeManageVolumePrivilege 3488 ichader.exe Token: SeImpersonatePrivilege 3488 ichader.exe Token: SeCreateGlobalPrivilege 3488 ichader.exe Token: 33 3488 ichader.exe Token: 34 3488 ichader.exe Token: 35 3488 ichader.exe Token: 36 3488 ichader.exe Token: SeDebugPrivilege 4080 ichader.exe Token: SeDebugPrivilege 4080 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exesvchost.execdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exeichader.exesvchost.exeichader.exeichader.exepid process 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe 752 svchost.exe 3700 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe 2120 ichader.exe 2336 svchost.exe 4080 ichader.exe 3488 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.execdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.execmd.exeichader.exedescription pid process target process PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 752 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe svchost.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 656 wrote to memory of 3700 656 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe PID 3700 wrote to memory of 504 3700 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cmd.exe PID 3700 wrote to memory of 504 3700 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cmd.exe PID 3700 wrote to memory of 504 3700 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe cmd.exe PID 504 wrote to memory of 3764 504 cmd.exe reg.exe PID 504 wrote to memory of 3764 504 cmd.exe reg.exe PID 504 wrote to memory of 3764 504 cmd.exe reg.exe PID 3700 wrote to memory of 2120 3700 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe ichader.exe PID 3700 wrote to memory of 2120 3700 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe ichader.exe PID 3700 wrote to memory of 2120 3700 cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe ichader.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 2336 2120 ichader.exe svchost.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 4080 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe PID 2120 wrote to memory of 3488 2120 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe"C:\Users\Admin\AppData\Local\Temp\cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:752 -
C:\Users\Admin\AppData\Local\Temp\cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe"C:\Users\Admin\AppData\Local\Temp\cdb79f86bc52dcdf01c69c593df5a6e75383545c6c1a12711da99a44686fe7f7.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKXEN.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
PID:3764 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2336 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4080 -
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3488
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LKXEN.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
68475f659a73ff72b9b0b9dfe58e531c
SHA1d9c5f4527a1078b083e8bebb6eab46a3c7faaa84
SHA256e3262b07826eac1b57fbbef21e4711ae0c2bcb1d0a26daebaeadfc8d3bfdc508
SHA5126e346fb9e3aa27d352fa00a4bcf25889be081f15f6cb4a2e88e90421840b15cd683d6b056da499dbe96dee0211228f0c90a8cf40a3cc16d03f7c48129a79dd84
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
68475f659a73ff72b9b0b9dfe58e531c
SHA1d9c5f4527a1078b083e8bebb6eab46a3c7faaa84
SHA256e3262b07826eac1b57fbbef21e4711ae0c2bcb1d0a26daebaeadfc8d3bfdc508
SHA5126e346fb9e3aa27d352fa00a4bcf25889be081f15f6cb4a2e88e90421840b15cd683d6b056da499dbe96dee0211228f0c90a8cf40a3cc16d03f7c48129a79dd84
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
68475f659a73ff72b9b0b9dfe58e531c
SHA1d9c5f4527a1078b083e8bebb6eab46a3c7faaa84
SHA256e3262b07826eac1b57fbbef21e4711ae0c2bcb1d0a26daebaeadfc8d3bfdc508
SHA5126e346fb9e3aa27d352fa00a4bcf25889be081f15f6cb4a2e88e90421840b15cd683d6b056da499dbe96dee0211228f0c90a8cf40a3cc16d03f7c48129a79dd84
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
68475f659a73ff72b9b0b9dfe58e531c
SHA1d9c5f4527a1078b083e8bebb6eab46a3c7faaa84
SHA256e3262b07826eac1b57fbbef21e4711ae0c2bcb1d0a26daebaeadfc8d3bfdc508
SHA5126e346fb9e3aa27d352fa00a4bcf25889be081f15f6cb4a2e88e90421840b15cd683d6b056da499dbe96dee0211228f0c90a8cf40a3cc16d03f7c48129a79dd84
-
memory/504-14-0x0000000000000000-mapping.dmp
-
memory/752-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/752-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/752-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/752-3-0x000000000040B000-mapping.dmp
-
memory/2120-20-0x0000000073B80000-0x0000000073C13000-memory.dmpFilesize
588KB
-
memory/2120-17-0x0000000000000000-mapping.dmp
-
memory/2336-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2336-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2336-24-0x000000000040B000-mapping.dmp
-
memory/3488-38-0x0000000073B80000-0x0000000073C13000-memory.dmpFilesize
588KB
-
memory/3488-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3488-33-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3488-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3488-34-0x00000000004B5210-mapping.dmp
-
memory/3700-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3700-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3700-8-0x00000000004085D0-mapping.dmp
-
memory/3700-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3764-16-0x0000000000000000-mapping.dmp
-
memory/4080-32-0x0000000073B80000-0x0000000073C13000-memory.dmpFilesize
588KB
-
memory/4080-29-0x00000000004085D0-mapping.dmp