Analysis
-
max time kernel
91s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
13db34cab435d9858269c5e823f4b575.exe
Resource
win7v20201028
General
-
Target
13db34cab435d9858269c5e823f4b575.exe
-
Size
1.2MB
-
MD5
13db34cab435d9858269c5e823f4b575
-
SHA1
c6e9c301d3cfaf6671490c47c1ed4eb59f343f21
-
SHA256
63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036
-
SHA512
dfd36c39b35cf1aed2b76e38d4a08c41792611cf886d337d129a19c963878cc53fb7a0d71e078d2d38e61d8341a938869686f62673f080a7182020cd08c2c6a8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svclip.exepid process 1460 svclip.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exesvclip.exedescription pid process target process PID 1064 set thread context of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1460 set thread context of 3288 1460 svclip.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exepid process 2192 13db34cab435d9858269c5e823f4b575.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exedescription pid process Token: SeDebugPrivilege 2192 13db34cab435d9858269c5e823f4b575.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
13db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exesvclip.exedescription pid process target process PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 1064 wrote to memory of 2192 1064 13db34cab435d9858269c5e823f4b575.exe 13db34cab435d9858269c5e823f4b575.exe PID 2192 wrote to memory of 1460 2192 13db34cab435d9858269c5e823f4b575.exe svclip.exe PID 2192 wrote to memory of 1460 2192 13db34cab435d9858269c5e823f4b575.exe svclip.exe PID 2192 wrote to memory of 1460 2192 13db34cab435d9858269c5e823f4b575.exe svclip.exe PID 1460 wrote to memory of 1928 1460 svclip.exe schtasks.exe PID 1460 wrote to memory of 1928 1460 svclip.exe schtasks.exe PID 1460 wrote to memory of 1928 1460 svclip.exe schtasks.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe PID 1460 wrote to memory of 3288 1460 svclip.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svclip.exe"C:\Users\Admin\AppData\Local\Temp\svclip.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ssWeviPUYoTiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE8F9.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\13db34cab435d9858269c5e823f4b575.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\svclip.exeMD5
dc9dad5b0a3f2aa8c2056f300670d2fc
SHA10e804acc7f1048f1cd2b10234f0df7bfab7d8e74
SHA2568d8701366f2def69b5887ebbfa3a5c2458a4c57b2fc17cf3a5f9769a5a77cd35
SHA512e66d02e472a436ba2d9774f625f4af8d6a677b18a421262b250781858d0245cb0d6e758c00060336e8af1abd87749ead36d848586f5c0d56082824c4c64a3dda
-
C:\Users\Admin\AppData\Local\Temp\svclip.exeMD5
dc9dad5b0a3f2aa8c2056f300670d2fc
SHA10e804acc7f1048f1cd2b10234f0df7bfab7d8e74
SHA2568d8701366f2def69b5887ebbfa3a5c2458a4c57b2fc17cf3a5f9769a5a77cd35
SHA512e66d02e472a436ba2d9774f625f4af8d6a677b18a421262b250781858d0245cb0d6e758c00060336e8af1abd87749ead36d848586f5c0d56082824c4c64a3dda
-
C:\Users\Admin\AppData\Local\Temp\tmpE8F9.tmpMD5
25447faf170764cd57bd88770f87d850
SHA12c9f9c85c0eae12e7ba4e69c3edcdfe25dca1010
SHA2561e6d1f20db5df22623b7e446a1dfc28c49d26ddc968a1892ea75f981e3117802
SHA5129b06a192857bfe447c82577ce557a22109ecbdbda13e8a636f4a6d4f193c314826045375b2ad0fdfa8bed9f9fc001a4954a47a0b812ffe8a54aba19131968bc3
-
memory/1064-118-0x00000000058C0000-0x0000000005DBE000-memory.dmpFilesize
5.0MB
-
memory/1064-120-0x0000000005D80000-0x0000000005D85000-memory.dmpFilesize
20KB
-
memory/1064-121-0x0000000009070000-0x0000000009071000-memory.dmpFilesize
4KB
-
memory/1064-122-0x00000000092C0000-0x0000000009367000-memory.dmpFilesize
668KB
-
memory/1064-123-0x000000000B980000-0x000000000B9DB000-memory.dmpFilesize
364KB
-
memory/1064-119-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/1064-114-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/1064-117-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/1064-116-0x0000000005DC0000-0x0000000005DC1000-memory.dmpFilesize
4KB
-
memory/1460-143-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/1460-140-0x0000000000000000-mapping.dmp
-
memory/1460-152-0x000000000AF30000-0x000000000AF35000-memory.dmpFilesize
20KB
-
memory/1460-151-0x00000000087B0000-0x0000000008809000-memory.dmpFilesize
356KB
-
memory/1460-150-0x0000000005230000-0x000000000572E000-memory.dmpFilesize
5.0MB
-
memory/1928-153-0x0000000000000000-mapping.dmp
-
memory/2192-137-0x0000000007170000-0x0000000007171000-memory.dmpFilesize
4KB
-
memory/2192-134-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/2192-138-0x0000000007870000-0x0000000007871000-memory.dmpFilesize
4KB
-
memory/2192-130-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/2192-129-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/2192-125-0x000000000041654E-mapping.dmp
-
memory/2192-131-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/2192-139-0x00000000070C0000-0x00000000070C1000-memory.dmpFilesize
4KB
-
memory/2192-133-0x00000000054B0000-0x0000000005AB6000-memory.dmpFilesize
6.0MB
-
memory/2192-132-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/2192-124-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3288-156-0x000000000040403E-mapping.dmp
-
memory/3288-155-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3288-162-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB