Analysis
-
max time kernel
138s -
max time network
53s -
platform
windows7_x64 -
resource
win7 -
submitted
20-09-2020 13:03
Static task
static1
Behavioral task
behavioral1
Sample
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe
Resource
win7
General
-
Target
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe
-
Size
814KB
-
MD5
f855dffcbd21d4e4a59eed5a7a392af9
-
SHA1
178dc356191ebca6bf294525183212ac2e5a0bd8
-
SHA256
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b
-
SHA512
0a08d1242a13c85f0f88ef54b77400da1a5c20570163635274ab9f63514e4b8b46a912dab28e3cc8a25963e39ade97b6310437587475893ff4935b4819c8ffbc
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Clipper.exeClipper.exepid process 1936 Clipper.exe 1624 Clipper.exe -
Drops startup file 2 IoCs
Processes:
Clipper.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome updater.exe Clipper.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome updater.exe Clipper.exe -
Loads dropped DLL 1 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exepid process 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeClipper.exedescription pid process target process PID 1492 set thread context of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1936 set thread context of 1624 1936 Clipper.exe Clipper.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 620 2040 WerFault.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeWerFault.exeClipper.exepid process 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe 620 WerFault.exe 620 WerFault.exe 620 WerFault.exe 620 WerFault.exe 620 WerFault.exe 1936 Clipper.exe 1936 Clipper.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exee44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeWerFault.exeClipper.exedescription pid process Token: SeDebugPrivilege 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Token: SeDebugPrivilege 2040 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Token: SeDebugPrivilege 620 WerFault.exe Token: SeDebugPrivilege 1936 Clipper.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exee44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeClipper.exedescription pid process target process PID 1492 wrote to memory of 1936 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Clipper.exe PID 1492 wrote to memory of 1936 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Clipper.exe PID 1492 wrote to memory of 1936 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Clipper.exe PID 1492 wrote to memory of 1936 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Clipper.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 1492 wrote to memory of 2040 1492 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 2040 wrote to memory of 620 2040 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe WerFault.exe PID 2040 wrote to memory of 620 2040 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe WerFault.exe PID 2040 wrote to memory of 620 2040 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe WerFault.exe PID 2040 wrote to memory of 620 2040 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe WerFault.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe PID 1936 wrote to memory of 1624 1936 Clipper.exe Clipper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"3⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 17483⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe
-
\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe
-
memory/620-40-0x0000000002880000-0x0000000002891000-memory.dmpFilesize
68KB
-
memory/620-23-0x0000000001EC0000-0x0000000001ED1000-memory.dmpFilesize
68KB
-
memory/620-22-0x0000000000000000-mapping.dmp
-
memory/1492-0-0x0000000073AF0000-0x00000000741DE000-memory.dmpFilesize
6.9MB
-
memory/1492-4-0x00000000003B0000-0x00000000003B5000-memory.dmpFilesize
20KB
-
memory/1492-3-0x0000000000390000-0x0000000000394000-memory.dmpFilesize
16KB
-
memory/1492-1-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1624-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1624-65-0x0000000073AF0000-0x00000000741DE000-memory.dmpFilesize
6.9MB
-
memory/1624-64-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1624-63-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1624-61-0x000000000040D54E-mapping.dmp
-
memory/1936-7-0x0000000000000000-mapping.dmp
-
memory/1936-20-0x0000000000660000-0x0000000000664000-memory.dmpFilesize
16KB
-
memory/1936-15-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/1936-58-0x0000000000680000-0x0000000000685000-memory.dmpFilesize
20KB
-
memory/1936-13-0x0000000073AF0000-0x00000000741DE000-memory.dmpFilesize
6.9MB
-
memory/2040-35-0x00000000004A110E-mapping.dmp
-
memory/2040-45-0x00000000004A110E-mapping.dmp
-
memory/2040-28-0x00000000004A110E-mapping.dmp
-
memory/2040-29-0x00000000004A110E-mapping.dmp
-
memory/2040-30-0x00000000004A110E-mapping.dmp
-
memory/2040-31-0x00000000004A110E-mapping.dmp
-
memory/2040-32-0x00000000004A110E-mapping.dmp
-
memory/2040-33-0x00000000004A110E-mapping.dmp
-
memory/2040-34-0x00000000004A110E-mapping.dmp
-
memory/2040-26-0x00000000004A110E-mapping.dmp
-
memory/2040-36-0x00000000004A110E-mapping.dmp
-
memory/2040-37-0x00000000004A110E-mapping.dmp
-
memory/2040-38-0x00000000004A110E-mapping.dmp
-
memory/2040-39-0x00000000004A110E-mapping.dmp
-
memory/2040-25-0x00000000004A110E-mapping.dmp
-
memory/2040-41-0x00000000004A110E-mapping.dmp
-
memory/2040-42-0x00000000004A110E-mapping.dmp
-
memory/2040-43-0x00000000004A110E-mapping.dmp
-
memory/2040-44-0x00000000004A110E-mapping.dmp
-
memory/2040-27-0x00000000004A110E-mapping.dmp
-
memory/2040-46-0x00000000004A110E-mapping.dmp
-
memory/2040-47-0x00000000004A110E-mapping.dmp
-
memory/2040-48-0x00000000004A110E-mapping.dmp
-
memory/2040-49-0x00000000004A110E-mapping.dmp
-
memory/2040-50-0x00000000004A110E-mapping.dmp
-
memory/2040-51-0x00000000004A110E-mapping.dmp
-
memory/2040-52-0x00000000004A110E-mapping.dmp
-
memory/2040-53-0x00000000004A110E-mapping.dmp
-
memory/2040-54-0x00000000004A110E-mapping.dmp
-
memory/2040-55-0x00000000004A110E-mapping.dmp
-
memory/2040-56-0x00000000004A110E-mapping.dmp
-
memory/2040-57-0x00000000004A110E-mapping.dmp
-
memory/2040-24-0x00000000004A110E-mapping.dmp
-
memory/2040-21-0x0000000005690000-0x0000000005700000-memory.dmpFilesize
448KB
-
memory/2040-16-0x0000000073AF0000-0x00000000741DE000-memory.dmpFilesize
6.9MB
-
memory/2040-14-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2040-12-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2040-10-0x00000000004A110E-mapping.dmp
-
memory/2040-9-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB