Analysis
-
max time kernel
62s -
max time network
110s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
20-09-2020 13:03
Static task
static1
Behavioral task
behavioral1
Sample
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe
Resource
win7
General
-
Target
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe
-
Size
814KB
-
MD5
f855dffcbd21d4e4a59eed5a7a392af9
-
SHA1
178dc356191ebca6bf294525183212ac2e5a0bd8
-
SHA256
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b
-
SHA512
0a08d1242a13c85f0f88ef54b77400da1a5c20570163635274ab9f63514e4b8b46a912dab28e3cc8a25963e39ade97b6310437587475893ff4935b4819c8ffbc
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Clipper.exeClipper.exepid process 3560 Clipper.exe 2620 Clipper.exe -
Drops startup file 2 IoCs
Processes:
Clipper.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome updater.exe Clipper.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome updater.exe Clipper.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 api.ipify.org 17 api.ipify.org 18 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeClipper.exedescription pid process target process PID 3992 set thread context of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3560 set thread context of 2620 3560 Clipper.exe Clipper.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3876 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeClipper.exee44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exepid process 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe 3560 Clipper.exe 3560 Clipper.exe 4008 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe 4008 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exee44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeClipper.exedescription pid process Token: SeDebugPrivilege 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Token: SeDebugPrivilege 4008 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Token: SeDebugPrivilege 3560 Clipper.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exeClipper.exee44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.execmd.exedescription pid process target process PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 4008 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe PID 3992 wrote to memory of 3560 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Clipper.exe PID 3992 wrote to memory of 3560 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Clipper.exe PID 3992 wrote to memory of 3560 3992 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 3560 wrote to memory of 2620 3560 Clipper.exe Clipper.exe PID 4008 wrote to memory of 2428 4008 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe cmd.exe PID 4008 wrote to memory of 2428 4008 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe cmd.exe PID 4008 wrote to memory of 2428 4008 e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe cmd.exe PID 2428 wrote to memory of 3876 2428 cmd.exe timeout.exe PID 2428 wrote to memory of 3876 2428 cmd.exe timeout.exe PID 2428 wrote to memory of 3876 2428 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"C:\Users\Admin\AppData\Local\Temp\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp857D.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe"3⤵
- Executes dropped EXE
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e44277fe9e90ba3107391676ad548812f33749da46db34ea877b1d6cdfb48d1b.exe.log
-
C:\Users\Admin\AppData\Local\Temp\tmp857D.tmp.bat
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\mvabvz\Clipper.exe
-
memory/2428-39-0x0000000000000000-mapping.dmp
-
memory/2620-31-0x0000000073490000-0x0000000073B7E000-memory.dmpFilesize
6.9MB
-
memory/2620-29-0x000000000040D54E-mapping.dmp
-
memory/2620-28-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3560-17-0x0000000073490000-0x0000000073B7E000-memory.dmpFilesize
6.9MB
-
memory/3560-19-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/3560-26-0x0000000006E10000-0x0000000006E15000-memory.dmpFilesize
20KB
-
memory/3560-25-0x0000000004ED0000-0x0000000004ED4000-memory.dmpFilesize
16KB
-
memory/3560-14-0x0000000000000000-mapping.dmp
-
memory/3876-42-0x0000000000000000-mapping.dmp
-
memory/3992-0-0x0000000073490000-0x0000000073B7E000-memory.dmpFilesize
6.9MB
-
memory/3992-7-0x0000000004EC0000-0x0000000004EC5000-memory.dmpFilesize
20KB
-
memory/3992-6-0x0000000004CA0000-0x0000000004CA4000-memory.dmpFilesize
16KB
-
memory/3992-5-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/3992-4-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/3992-3-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/3992-1-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/4008-24-0x0000000006120000-0x0000000006190000-memory.dmpFilesize
448KB
-
memory/4008-18-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/4008-10-0x00000000004A110E-mapping.dmp
-
memory/4008-9-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4008-36-0x0000000006260000-0x0000000006261000-memory.dmpFilesize
4KB
-
memory/4008-11-0x0000000073490000-0x0000000073B7E000-memory.dmpFilesize
6.9MB