Overview
overview
10Static
static
80x00010000...55.exe
windows7_x64
10x00010000...55.exe
windows10_x64
10x00010000...47.exe
windows7_x64
10x00010000...47.exe
windows10_x64
10x00010000...70.exe
windows7_x64
80x00010000...70.exe
windows10_x64
80x00010000...13.exe
windows7_x64
80x00010000...13.exe
windows10_x64
80x00020000...73.exe
windows7_x64
10x00020000...73.exe
windows10_x64
10x00020000...83.exe
windows7_x64
100x00020000...83.exe
windows10_x64
100x00020000...36.exe
windows7_x64
80x00020000...36.exe
windows10_x64
80x00020000...40.exe
windows7_x64
70x00020000...40.exe
windows10_x64
70x00030000...09.exe
windows7_x64
100x00030000...09.exe
windows10_x64
100x00030000...22.exe
windows7_x64
100x00030000...22.exe
windows10_x64
100x00030000...26.exe
windows7_x64
100x00030000...26.exe
windows10_x64
0x00030000...34.exe
windows7_x64
100x00030000...34.exe
windows10_x64
100x00030000...06.exe
windows7_x64
100x00030000...06.exe
windows10_x64
100x00030000...41.exe
windows7_x64
100x00030000...41.exe
windows10_x64
100x00030000...45.exe
windows7_x64
10x00030000...45.exe
windows10_x64
10x00030000...48.exe
windows7_x64
80x00030000...48.exe
windows10_x64
8Analysis
-
max time kernel
13s -
max time network
20s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
25-11-2020 10:45
Behavioral task
behavioral1
Sample
0x000100000001ab86-55.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0x000100000001ab86-55.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
0x000100000001ab87-47.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
0x000100000001ab87-47.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
0x000100000001ab9c-70.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
0x000100000001ab9c-70.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
0x000100000001ad02-313.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
0x000100000001ad02-313.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
0x000200000001aca8-173.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
0x000200000001aca8-173.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
0x000200000001acb5-183.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
0x000200000001acb5-183.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
0x000200000001acdf-236.exe
Resource
win7v20201028
Behavioral task
behavioral14
Sample
0x000200000001acdf-236.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
0x000200000001ace9-240.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
0x000200000001ace9-240.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
0x000300000001a5a2-209.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
0x000300000001a5a2-209.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
0x000300000001ac90-122.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
0x000300000001ac90-122.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
0x000300000001ac99-126.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
0x000300000001ac99-126.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
0x000300000001ac9e-134.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
0x000300000001ac9e-134.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
0x000300000001ac9e-206.exe
Resource
win7v20201028
Behavioral task
behavioral26
Sample
0x000300000001ac9e-206.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
0x000300000001ac9f-141.exe
Resource
win7v20201028
Behavioral task
behavioral28
Sample
0x000300000001ac9f-141.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
0x000300000001acec-245.exe
Resource
win7v20201028
Behavioral task
behavioral30
Sample
0x000300000001acec-245.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
0x000300000001aced-248.exe
Resource
win7v20201028
Behavioral task
behavioral32
Sample
0x000300000001aced-248.exe
Resource
win10v20201028
General
-
Target
0x000100000001ad02-313.exe
-
Size
620KB
-
MD5
7f1c0fe70e588f3bead08b64910b455e
-
SHA1
b0d78d67ee8a703e2c5dff5f50b34c504a91cfee
-
SHA256
4788a1207c8a83d6051a12d1bbc63e889fbf142e9479c8d2919e8dcb0e4a6cc4
-
SHA512
e5c5227943683851d393328d41c86066ece40f6813533f010963f5515d369d3aa57175f169aef9f428deca38810be75ee8d40b735a0af8826fd7c1bb444b1a84
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
SmartClock.exepid process 1720 SmartClock.exe -
Drops startup file 1 IoCs
Processes:
0x000100000001ad02-313.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 0x000100000001ad02-313.exe -
Loads dropped DLL 3 IoCs
Processes:
0x000100000001ad02-313.exepid process 1852 0x000100000001ad02-313.exe 1852 0x000100000001ad02-313.exe 1852 0x000100000001ad02-313.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 1720 SmartClock.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0x000100000001ad02-313.exedescription pid process target process PID 1852 wrote to memory of 1720 1852 0x000100000001ad02-313.exe SmartClock.exe PID 1852 wrote to memory of 1720 1852 0x000100000001ad02-313.exe SmartClock.exe PID 1852 wrote to memory of 1720 1852 0x000100000001ad02-313.exe SmartClock.exe PID 1852 wrote to memory of 1720 1852 0x000100000001ad02-313.exe SmartClock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000100000001ad02-313.exe"C:\Users\Admin\AppData\Local\Temp\0x000100000001ad02-313.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
7f1c0fe70e588f3bead08b64910b455e
SHA1b0d78d67ee8a703e2c5dff5f50b34c504a91cfee
SHA2564788a1207c8a83d6051a12d1bbc63e889fbf142e9479c8d2919e8dcb0e4a6cc4
SHA512e5c5227943683851d393328d41c86066ece40f6813533f010963f5515d369d3aa57175f169aef9f428deca38810be75ee8d40b735a0af8826fd7c1bb444b1a84
-
\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
7f1c0fe70e588f3bead08b64910b455e
SHA1b0d78d67ee8a703e2c5dff5f50b34c504a91cfee
SHA2564788a1207c8a83d6051a12d1bbc63e889fbf142e9479c8d2919e8dcb0e4a6cc4
SHA512e5c5227943683851d393328d41c86066ece40f6813533f010963f5515d369d3aa57175f169aef9f428deca38810be75ee8d40b735a0af8826fd7c1bb444b1a84
-
\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
7f1c0fe70e588f3bead08b64910b455e
SHA1b0d78d67ee8a703e2c5dff5f50b34c504a91cfee
SHA2564788a1207c8a83d6051a12d1bbc63e889fbf142e9479c8d2919e8dcb0e4a6cc4
SHA512e5c5227943683851d393328d41c86066ece40f6813533f010963f5515d369d3aa57175f169aef9f428deca38810be75ee8d40b735a0af8826fd7c1bb444b1a84
-
\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
7f1c0fe70e588f3bead08b64910b455e
SHA1b0d78d67ee8a703e2c5dff5f50b34c504a91cfee
SHA2564788a1207c8a83d6051a12d1bbc63e889fbf142e9479c8d2919e8dcb0e4a6cc4
SHA512e5c5227943683851d393328d41c86066ece40f6813533f010963f5515d369d3aa57175f169aef9f428deca38810be75ee8d40b735a0af8826fd7c1bb444b1a84
-
memory/1720-4-0x0000000000000000-mapping.dmp
-
memory/1720-6-0x0000000006190000-0x00000000061A1000-memory.dmpFilesize
68KB
-
memory/1852-0-0x0000000005FE0000-0x0000000005FF1000-memory.dmpFilesize
68KB