Analysis
-
max time kernel
8s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:50
Static task
static1
Behavioral task
behavioral1
Sample
1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe
Resource
win7v20201028
General
-
Target
1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe
-
Size
1.5MB
-
MD5
f698d9599a22fa3e124d701f980e7e03
-
SHA1
0e427b8f1bc24adfe0f7987f3dcc3114b5d42db2
-
SHA256
1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d
-
SHA512
af872f3d3373f94e05626a20e4e24128b8d7eb243135ba07b9ffd7487c2d627c1bd03c40c0dccedca3c8ceda15d5622f3da82c4840359660e39ae06608096e88
Malware Config
Extracted
darkcomet
Runescape
mrsnickers03.no-ip.biz:340
DC_MUTEX-6ZFK11A
-
gencode
uNwew4gojxtu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ichader.exeichader.exeichader.exepid process 1520 ichader.exe 684 ichader.exe 2912 ichader.exe -
Processes:
resource yara_rule behavioral2/memory/1168-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1168-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1168-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2912-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2912-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2912-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exeichader.exedescription pid process target process PID 1180 set thread context of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 set thread context of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1520 set thread context of 3588 1520 ichader.exe svchost.exe PID 1520 set thread context of 684 1520 ichader.exe ichader.exe PID 1520 set thread context of 2912 1520 ichader.exe ichader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ichader.exedescription pid process Token: SeIncreaseQuotaPrivilege 2912 ichader.exe Token: SeSecurityPrivilege 2912 ichader.exe Token: SeTakeOwnershipPrivilege 2912 ichader.exe Token: SeLoadDriverPrivilege 2912 ichader.exe Token: SeSystemProfilePrivilege 2912 ichader.exe Token: SeSystemtimePrivilege 2912 ichader.exe Token: SeProfSingleProcessPrivilege 2912 ichader.exe Token: SeIncBasePriorityPrivilege 2912 ichader.exe Token: SeCreatePagefilePrivilege 2912 ichader.exe Token: SeBackupPrivilege 2912 ichader.exe Token: SeRestorePrivilege 2912 ichader.exe Token: SeShutdownPrivilege 2912 ichader.exe Token: SeDebugPrivilege 2912 ichader.exe Token: SeSystemEnvironmentPrivilege 2912 ichader.exe Token: SeChangeNotifyPrivilege 2912 ichader.exe Token: SeRemoteShutdownPrivilege 2912 ichader.exe Token: SeUndockPrivilege 2912 ichader.exe Token: SeManageVolumePrivilege 2912 ichader.exe Token: SeImpersonatePrivilege 2912 ichader.exe Token: SeCreateGlobalPrivilege 2912 ichader.exe Token: 33 2912 ichader.exe Token: 34 2912 ichader.exe Token: 35 2912 ichader.exe Token: 36 2912 ichader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exesvchost.exe1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exeichader.exesvchost.exeichader.exeichader.exepid process 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 2196 svchost.exe 1168 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1520 ichader.exe 3588 svchost.exe 684 ichader.exe 2912 ichader.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.execmd.exeichader.exedescription pid process target process PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 2196 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe svchost.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1180 wrote to memory of 1168 1180 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe PID 1168 wrote to memory of 708 1168 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe cmd.exe PID 1168 wrote to memory of 708 1168 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe cmd.exe PID 1168 wrote to memory of 708 1168 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe cmd.exe PID 708 wrote to memory of 776 708 cmd.exe reg.exe PID 708 wrote to memory of 776 708 cmd.exe reg.exe PID 708 wrote to memory of 776 708 cmd.exe reg.exe PID 1168 wrote to memory of 1520 1168 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe ichader.exe PID 1168 wrote to memory of 1520 1168 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe ichader.exe PID 1168 wrote to memory of 1520 1168 1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe ichader.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 3588 1520 ichader.exe svchost.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 684 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe PID 1520 wrote to memory of 2912 1520 ichader.exe ichader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe"C:\Users\Admin\AppData\Local\Temp\1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe"C:\Users\Admin\AppData\Local\Temp\1799808de09806324f588feb45dc4f5a60bb0dc558cf183395f93858f034e91d.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SXIGK.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SXIGK.batMD5
92353035f01403e26aa2ff51c3963238
SHA1d13f167c73bfce23a2deab8ce7c4ce9f78759ff4
SHA2562e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870
SHA51274560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0c6f0276921d35df709027b9e96af1fc
SHA1c03714a922e9b988f36c34bee5491c2cd709b4d6
SHA256a80d952f179eb8e4c91d3ead283894bae1e870f052d17c722c26ef70759f22c9
SHA5122b293bae0c25cb9c22848614718ecac3eb7f9ed26f0d877e88efa1bc5044138ebbe5b6cae66b769ad9251dabb229607e4c9342cb971315080cc863ec2d6f14b5
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0c6f0276921d35df709027b9e96af1fc
SHA1c03714a922e9b988f36c34bee5491c2cd709b4d6
SHA256a80d952f179eb8e4c91d3ead283894bae1e870f052d17c722c26ef70759f22c9
SHA5122b293bae0c25cb9c22848614718ecac3eb7f9ed26f0d877e88efa1bc5044138ebbe5b6cae66b769ad9251dabb229607e4c9342cb971315080cc863ec2d6f14b5
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0c6f0276921d35df709027b9e96af1fc
SHA1c03714a922e9b988f36c34bee5491c2cd709b4d6
SHA256a80d952f179eb8e4c91d3ead283894bae1e870f052d17c722c26ef70759f22c9
SHA5122b293bae0c25cb9c22848614718ecac3eb7f9ed26f0d877e88efa1bc5044138ebbe5b6cae66b769ad9251dabb229607e4c9342cb971315080cc863ec2d6f14b5
-
C:\Users\Admin\AppData\Roaming\IDM\ichader.exeMD5
0c6f0276921d35df709027b9e96af1fc
SHA1c03714a922e9b988f36c34bee5491c2cd709b4d6
SHA256a80d952f179eb8e4c91d3ead283894bae1e870f052d17c722c26ef70759f22c9
SHA5122b293bae0c25cb9c22848614718ecac3eb7f9ed26f0d877e88efa1bc5044138ebbe5b6cae66b769ad9251dabb229607e4c9342cb971315080cc863ec2d6f14b5
-
memory/684-29-0x00000000004085D0-mapping.dmp
-
memory/684-32-0x0000000073830000-0x00000000738C3000-memory.dmpFilesize
588KB
-
memory/708-14-0x0000000000000000-mapping.dmp
-
memory/776-16-0x0000000000000000-mapping.dmp
-
memory/1168-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1168-9-0x00000000004085D0-mapping.dmp
-
memory/1168-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1168-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1520-17-0x0000000000000000-mapping.dmp
-
memory/1520-20-0x0000000073830000-0x00000000738C3000-memory.dmpFilesize
588KB
-
memory/2196-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2196-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2196-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2196-3-0x000000000040B000-mapping.dmp
-
memory/2912-33-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2912-38-0x0000000073830000-0x00000000738C3000-memory.dmpFilesize
588KB
-
memory/2912-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2912-35-0x00000000004B5210-mapping.dmp
-
memory/2912-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3588-24-0x000000000040B000-mapping.dmp
-
memory/3588-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3588-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB