Analysis

  • max time kernel
    91s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-04-2021 08:16

General

  • Target

    13db34cab435d9858269c5e823f4b575.exe

  • Size

    1.2MB

  • MD5

    13db34cab435d9858269c5e823f4b575

  • SHA1

    c6e9c301d3cfaf6671490c47c1ed4eb59f343f21

  • SHA256

    63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036

  • SHA512

    dfd36c39b35cf1aed2b76e38d4a08c41792611cf886d337d129a19c963878cc53fb7a0d71e078d2d38e61d8341a938869686f62673f080a7182020cd08c2c6a8

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe
    "C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Users\Admin\AppData\Local\Temp\svclip.exe
        "C:\Users\Admin\AppData\Local\Temp\svclip.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ssWeviPUYoTiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE8F9.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:1928
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "{path}"
          4⤵
            PID:3288

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\13db34cab435d9858269c5e823f4b575.exe.log
      MD5

      0c2899d7c6746f42d5bbe088c777f94c

      SHA1

      622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

      SHA256

      5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

      SHA512

      ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

    • C:\Users\Admin\AppData\Local\Temp\svclip.exe
      MD5

      dc9dad5b0a3f2aa8c2056f300670d2fc

      SHA1

      0e804acc7f1048f1cd2b10234f0df7bfab7d8e74

      SHA256

      8d8701366f2def69b5887ebbfa3a5c2458a4c57b2fc17cf3a5f9769a5a77cd35

      SHA512

      e66d02e472a436ba2d9774f625f4af8d6a677b18a421262b250781858d0245cb0d6e758c00060336e8af1abd87749ead36d848586f5c0d56082824c4c64a3dda

    • C:\Users\Admin\AppData\Local\Temp\svclip.exe
      MD5

      dc9dad5b0a3f2aa8c2056f300670d2fc

      SHA1

      0e804acc7f1048f1cd2b10234f0df7bfab7d8e74

      SHA256

      8d8701366f2def69b5887ebbfa3a5c2458a4c57b2fc17cf3a5f9769a5a77cd35

      SHA512

      e66d02e472a436ba2d9774f625f4af8d6a677b18a421262b250781858d0245cb0d6e758c00060336e8af1abd87749ead36d848586f5c0d56082824c4c64a3dda

    • C:\Users\Admin\AppData\Local\Temp\tmpE8F9.tmp
      MD5

      25447faf170764cd57bd88770f87d850

      SHA1

      2c9f9c85c0eae12e7ba4e69c3edcdfe25dca1010

      SHA256

      1e6d1f20db5df22623b7e446a1dfc28c49d26ddc968a1892ea75f981e3117802

      SHA512

      9b06a192857bfe447c82577ce557a22109ecbdbda13e8a636f4a6d4f193c314826045375b2ad0fdfa8bed9f9fc001a4954a47a0b812ffe8a54aba19131968bc3

    • memory/1064-118-0x00000000058C0000-0x0000000005DBE000-memory.dmp
      Filesize

      5.0MB

    • memory/1064-120-0x0000000005D80000-0x0000000005D85000-memory.dmp
      Filesize

      20KB

    • memory/1064-121-0x0000000009070000-0x0000000009071000-memory.dmp
      Filesize

      4KB

    • memory/1064-122-0x00000000092C0000-0x0000000009367000-memory.dmp
      Filesize

      668KB

    • memory/1064-123-0x000000000B980000-0x000000000B9DB000-memory.dmp
      Filesize

      364KB

    • memory/1064-119-0x00000000058D0000-0x00000000058D1000-memory.dmp
      Filesize

      4KB

    • memory/1064-114-0x0000000000F70000-0x0000000000F71000-memory.dmp
      Filesize

      4KB

    • memory/1064-117-0x0000000005960000-0x0000000005961000-memory.dmp
      Filesize

      4KB

    • memory/1064-116-0x0000000005DC0000-0x0000000005DC1000-memory.dmp
      Filesize

      4KB

    • memory/1460-143-0x00000000009B0000-0x00000000009B1000-memory.dmp
      Filesize

      4KB

    • memory/1460-140-0x0000000000000000-mapping.dmp
    • memory/1460-152-0x000000000AF30000-0x000000000AF35000-memory.dmp
      Filesize

      20KB

    • memory/1460-151-0x00000000087B0000-0x0000000008809000-memory.dmp
      Filesize

      356KB

    • memory/1460-150-0x0000000005230000-0x000000000572E000-memory.dmp
      Filesize

      5.0MB

    • memory/1928-153-0x0000000000000000-mapping.dmp
    • memory/2192-137-0x0000000007170000-0x0000000007171000-memory.dmp
      Filesize

      4KB

    • memory/2192-134-0x0000000005880000-0x0000000005881000-memory.dmp
      Filesize

      4KB

    • memory/2192-138-0x0000000007870000-0x0000000007871000-memory.dmp
      Filesize

      4KB

    • memory/2192-130-0x0000000005570000-0x0000000005571000-memory.dmp
      Filesize

      4KB

    • memory/2192-129-0x0000000005AC0000-0x0000000005AC1000-memory.dmp
      Filesize

      4KB

    • memory/2192-125-0x000000000041654E-mapping.dmp
    • memory/2192-131-0x00000000055D0000-0x00000000055D1000-memory.dmp
      Filesize

      4KB

    • memory/2192-139-0x00000000070C0000-0x00000000070C1000-memory.dmp
      Filesize

      4KB

    • memory/2192-133-0x00000000054B0000-0x0000000005AB6000-memory.dmp
      Filesize

      6.0MB

    • memory/2192-132-0x0000000005610000-0x0000000005611000-memory.dmp
      Filesize

      4KB

    • memory/2192-124-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

    • memory/3288-156-0x000000000040403E-mapping.dmp
    • memory/3288-155-0x0000000000400000-0x000000000040A000-memory.dmp
      Filesize

      40KB

    • memory/3288-162-0x0000000005590000-0x0000000005591000-memory.dmp
      Filesize

      4KB