Analysis
-
max time kernel
84s -
max time network
53s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
13db34cab435d9858269c5e823f4b575.exe
Resource
win7v20201028
General
-
Target
13db34cab435d9858269c5e823f4b575.exe
-
Size
1.2MB
-
MD5
13db34cab435d9858269c5e823f4b575
-
SHA1
c6e9c301d3cfaf6671490c47c1ed4eb59f343f21
-
SHA256
63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036
-
SHA512
dfd36c39b35cf1aed2b76e38d4a08c41792611cf886d337d129a19c963878cc53fb7a0d71e078d2d38e61d8341a938869686f62673f080a7182020cd08c2c6a8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svclip.exepid process 1740 svclip.exe -
Loads dropped DLL 1 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exepid process 788 13db34cab435d9858269c5e823f4b575.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exesvclip.exedescription pid process target process PID 1904 set thread context of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1740 set thread context of 1688 1740 svclip.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exepid process 788 13db34cab435d9858269c5e823f4b575.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exedescription pid process Token: SeDebugPrivilege 788 13db34cab435d9858269c5e823f4b575.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exesvclip.exedescription pid process target process PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1904 wrote to memory of 788 1904 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 788 wrote to memory of 1740 788 13db34cab435d9858269c5e823f4b575.exe svclip.exe PID 788 wrote to memory of 1740 788 13db34cab435d9858269c5e823f4b575.exe svclip.exe PID 788 wrote to memory of 1740 788 13db34cab435d9858269c5e823f4b575.exe svclip.exe PID 788 wrote to memory of 1740 788 13db34cab435d9858269c5e823f4b575.exe svclip.exe PID 1740 wrote to memory of 1920 1740 svclip.exe schtasks.exe PID 1740 wrote to memory of 1920 1740 svclip.exe schtasks.exe PID 1740 wrote to memory of 1920 1740 svclip.exe schtasks.exe PID 1740 wrote to memory of 1920 1740 svclip.exe schtasks.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe PID 1740 wrote to memory of 1688 1740 svclip.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svclip.exe"C:\Users\Admin\AppData\Local\Temp\svclip.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ssWeviPUYoTiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FB6.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svclip.exeMD5
b43b82493284862ef7d7e7b8feaf8e4f
SHA1de7ef2944d30c82b52e5e802d69c59b987483bc3
SHA25688c2393e039e2a6e94bfc865b261d07e6491c9ab8114b35cb05a3a69ad2cc59c
SHA512654577a704d8ffd1ccce55d2420b09ea6b639d1a66f1d1de9f3bb0bb91cae36c950065d720537137c30636257e6c7e6a6c06b9d7ff3d11f5da2283f86c5ca04f
-
C:\Users\Admin\AppData\Local\Temp\svclip.exeMD5
b43b82493284862ef7d7e7b8feaf8e4f
SHA1de7ef2944d30c82b52e5e802d69c59b987483bc3
SHA25688c2393e039e2a6e94bfc865b261d07e6491c9ab8114b35cb05a3a69ad2cc59c
SHA512654577a704d8ffd1ccce55d2420b09ea6b639d1a66f1d1de9f3bb0bb91cae36c950065d720537137c30636257e6c7e6a6c06b9d7ff3d11f5da2283f86c5ca04f
-
C:\Users\Admin\AppData\Local\Temp\tmp4FB6.tmpMD5
5f7d04218e1fc858d0e8d54648a300a6
SHA1e884324e76bf793de6a0bb40026b571fe38ee051
SHA256b50263340d8e5745ce0e59fd8036835557e929573472434e34155326c8bb5ec4
SHA51213023e5cce4311e4aa8cfbe4394290320182f6e5016692d2313d1888eaf6e1625b787fc84605648465ac1db703e77838f6d9edc1dede060f840998ef5094afcb
-
\Users\Admin\AppData\Local\Temp\svclip.exeMD5
b43b82493284862ef7d7e7b8feaf8e4f
SHA1de7ef2944d30c82b52e5e802d69c59b987483bc3
SHA25688c2393e039e2a6e94bfc865b261d07e6491c9ab8114b35cb05a3a69ad2cc59c
SHA512654577a704d8ffd1ccce55d2420b09ea6b639d1a66f1d1de9f3bb0bb91cae36c950065d720537137c30636257e6c7e6a6c06b9d7ff3d11f5da2283f86c5ca04f
-
memory/788-65-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/788-66-0x000000000041654E-mapping.dmp
-
memory/788-67-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/788-69-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/1688-86-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/1688-84-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1688-83-0x000000000040403E-mapping.dmp
-
memory/1688-82-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1740-71-0x0000000000000000-mapping.dmp
-
memory/1740-74-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/1740-77-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/1740-78-0x0000000004880000-0x00000000048D9000-memory.dmpFilesize
356KB
-
memory/1740-79-0x0000000000430000-0x0000000000435000-memory.dmpFilesize
20KB
-
memory/1904-59-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/1904-64-0x0000000005120000-0x000000000517B000-memory.dmpFilesize
364KB
-
memory/1904-63-0x0000000007D40000-0x0000000007DE7000-memory.dmpFilesize
668KB
-
memory/1904-62-0x00000000004E0000-0x00000000004E5000-memory.dmpFilesize
20KB
-
memory/1904-61-0x00000000042D0000-0x00000000042D1000-memory.dmpFilesize
4KB
-
memory/1920-80-0x0000000000000000-mapping.dmp