13db34cab435d9858269c5e823f4b575.exe

General
Target

13db34cab435d9858269c5e823f4b575.exe

Filesize

1MB

Completed

08-04-2021 08:18

Score
8 /10
MD5

13db34cab435d9858269c5e823f4b575

SHA1

c6e9c301d3cfaf6671490c47c1ed4eb59f343f21

SHA256

63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036

Malware Config
Signatures 11

Filter: none

Collection
Credential Access
Discovery
Persistence
  • Executes dropped EXE
    svclip.exe

    Reported IOCs

    pidprocess
    1740svclip.exe
  • Loads dropped DLL
    13db34cab435d9858269c5e823f4b575.exe

    Reported IOCs

    pidprocess
    78813db34cab435d9858269c5e823f4b575.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Suspicious use of SetThreadContext
    13db34cab435d9858269c5e823f4b575.exesvclip.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1904 set thread context of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1740 set thread context of 16881740svclip.exeRegSvcs.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1920schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    13db34cab435d9858269c5e823f4b575.exe

    Reported IOCs

    pidprocess
    78813db34cab435d9858269c5e823f4b575.exe
  • Suspicious use of AdjustPrivilegeToken
    13db34cab435d9858269c5e823f4b575.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege78813db34cab435d9858269c5e823f4b575.exe
  • Suspicious use of WriteProcessMemory
    13db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exesvclip.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1904 wrote to memory of 788190413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 788 wrote to memory of 174078813db34cab435d9858269c5e823f4b575.exesvclip.exe
    PID 788 wrote to memory of 174078813db34cab435d9858269c5e823f4b575.exesvclip.exe
    PID 788 wrote to memory of 174078813db34cab435d9858269c5e823f4b575.exesvclip.exe
    PID 788 wrote to memory of 174078813db34cab435d9858269c5e823f4b575.exesvclip.exe
    PID 1740 wrote to memory of 19201740svclip.exeschtasks.exe
    PID 1740 wrote to memory of 19201740svclip.exeschtasks.exe
    PID 1740 wrote to memory of 19201740svclip.exeschtasks.exe
    PID 1740 wrote to memory of 19201740svclip.exeschtasks.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
    PID 1740 wrote to memory of 16881740svclip.exeRegSvcs.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe
    "C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe
      "{path}"
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:788
      • C:\Users\Admin\AppData\Local\Temp\svclip.exe
        "C:\Users\Admin\AppData\Local\Temp\svclip.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ssWeviPUYoTiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FB6.tmp"
          Creates scheduled task(s)
          PID:1920
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "{path}"
          PID:1688
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\Users\Admin\AppData\Local\Temp\svclip.exe

                    MD5

                    b43b82493284862ef7d7e7b8feaf8e4f

                    SHA1

                    de7ef2944d30c82b52e5e802d69c59b987483bc3

                    SHA256

                    88c2393e039e2a6e94bfc865b261d07e6491c9ab8114b35cb05a3a69ad2cc59c

                    SHA512

                    654577a704d8ffd1ccce55d2420b09ea6b639d1a66f1d1de9f3bb0bb91cae36c950065d720537137c30636257e6c7e6a6c06b9d7ff3d11f5da2283f86c5ca04f

                  • C:\Users\Admin\AppData\Local\Temp\svclip.exe

                    MD5

                    b43b82493284862ef7d7e7b8feaf8e4f

                    SHA1

                    de7ef2944d30c82b52e5e802d69c59b987483bc3

                    SHA256

                    88c2393e039e2a6e94bfc865b261d07e6491c9ab8114b35cb05a3a69ad2cc59c

                    SHA512

                    654577a704d8ffd1ccce55d2420b09ea6b639d1a66f1d1de9f3bb0bb91cae36c950065d720537137c30636257e6c7e6a6c06b9d7ff3d11f5da2283f86c5ca04f

                  • C:\Users\Admin\AppData\Local\Temp\tmp4FB6.tmp

                    MD5

                    5f7d04218e1fc858d0e8d54648a300a6

                    SHA1

                    e884324e76bf793de6a0bb40026b571fe38ee051

                    SHA256

                    b50263340d8e5745ce0e59fd8036835557e929573472434e34155326c8bb5ec4

                    SHA512

                    13023e5cce4311e4aa8cfbe4394290320182f6e5016692d2313d1888eaf6e1625b787fc84605648465ac1db703e77838f6d9edc1dede060f840998ef5094afcb

                  • \Users\Admin\AppData\Local\Temp\svclip.exe

                    MD5

                    b43b82493284862ef7d7e7b8feaf8e4f

                    SHA1

                    de7ef2944d30c82b52e5e802d69c59b987483bc3

                    SHA256

                    88c2393e039e2a6e94bfc865b261d07e6491c9ab8114b35cb05a3a69ad2cc59c

                    SHA512

                    654577a704d8ffd1ccce55d2420b09ea6b639d1a66f1d1de9f3bb0bb91cae36c950065d720537137c30636257e6c7e6a6c06b9d7ff3d11f5da2283f86c5ca04f

                  • memory/788-67-0x0000000000400000-0x000000000041C000-memory.dmp

                  • memory/788-69-0x0000000004E50000-0x0000000004E51000-memory.dmp

                  • memory/788-65-0x0000000000400000-0x000000000041C000-memory.dmp

                  • memory/788-66-0x000000000041654E-mapping.dmp

                  • memory/1688-84-0x0000000000400000-0x000000000040A000-memory.dmp

                  • memory/1688-83-0x000000000040403E-mapping.dmp

                  • memory/1688-82-0x0000000000400000-0x000000000040A000-memory.dmp

                  • memory/1688-86-0x0000000004B00000-0x0000000004B01000-memory.dmp

                  • memory/1740-71-0x0000000000000000-mapping.dmp

                  • memory/1740-74-0x00000000010D0000-0x00000000010D1000-memory.dmp

                  • memory/1740-77-0x0000000000690000-0x0000000000691000-memory.dmp

                  • memory/1740-78-0x0000000004880000-0x00000000048D9000-memory.dmp

                  • memory/1740-79-0x0000000000430000-0x0000000000435000-memory.dmp

                  • memory/1904-64-0x0000000005120000-0x000000000517B000-memory.dmp

                  • memory/1904-63-0x0000000007D40000-0x0000000007DE7000-memory.dmp

                  • memory/1904-62-0x00000000004E0000-0x00000000004E5000-memory.dmp

                  • memory/1904-61-0x00000000042D0000-0x00000000042D1000-memory.dmp

                  • memory/1904-59-0x0000000000840000-0x0000000000841000-memory.dmp

                  • memory/1920-80-0x0000000000000000-mapping.dmp