13db34cab435d9858269c5e823f4b575.exe

General
Target

13db34cab435d9858269c5e823f4b575.exe

Filesize

1MB

Completed

08-04-2021 08:18

Score
8 /10
MD5

13db34cab435d9858269c5e823f4b575

SHA1

c6e9c301d3cfaf6671490c47c1ed4eb59f343f21

SHA256

63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036

Malware Config
Signatures 10

Filter: none

Collection
Credential Access
Discovery
Persistence
  • Executes dropped EXE
    svclip.exe

    Reported IOCs

    pidprocess
    1460svclip.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Suspicious use of SetThreadContext
    13db34cab435d9858269c5e823f4b575.exesvclip.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1064 set thread context of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1460 set thread context of 32881460svclip.exeRegSvcs.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1928schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    13db34cab435d9858269c5e823f4b575.exe

    Reported IOCs

    pidprocess
    219213db34cab435d9858269c5e823f4b575.exe
  • Suspicious use of AdjustPrivilegeToken
    13db34cab435d9858269c5e823f4b575.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege219213db34cab435d9858269c5e823f4b575.exe
  • Suspicious use of WriteProcessMemory
    13db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exesvclip.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 1064 wrote to memory of 2192106413db34cab435d9858269c5e823f4b575.exe13db34cab435d9858269c5e823f4b575.exe
    PID 2192 wrote to memory of 1460219213db34cab435d9858269c5e823f4b575.exesvclip.exe
    PID 2192 wrote to memory of 1460219213db34cab435d9858269c5e823f4b575.exesvclip.exe
    PID 2192 wrote to memory of 1460219213db34cab435d9858269c5e823f4b575.exesvclip.exe
    PID 1460 wrote to memory of 19281460svclip.exeschtasks.exe
    PID 1460 wrote to memory of 19281460svclip.exeschtasks.exe
    PID 1460 wrote to memory of 19281460svclip.exeschtasks.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
    PID 1460 wrote to memory of 32881460svclip.exeRegSvcs.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe
    "C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Users\Admin\AppData\Local\Temp\13db34cab435d9858269c5e823f4b575.exe
      "{path}"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Users\Admin\AppData\Local\Temp\svclip.exe
        "C:\Users\Admin\AppData\Local\Temp\svclip.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ssWeviPUYoTiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE8F9.tmp"
          Creates scheduled task(s)
          PID:1928
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "{path}"
          PID:3288
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\13db34cab435d9858269c5e823f4b575.exe.log

                    MD5

                    0c2899d7c6746f42d5bbe088c777f94c

                    SHA1

                    622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

                    SHA256

                    5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

                    SHA512

                    ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

                  • C:\Users\Admin\AppData\Local\Temp\svclip.exe

                    MD5

                    dc9dad5b0a3f2aa8c2056f300670d2fc

                    SHA1

                    0e804acc7f1048f1cd2b10234f0df7bfab7d8e74

                    SHA256

                    8d8701366f2def69b5887ebbfa3a5c2458a4c57b2fc17cf3a5f9769a5a77cd35

                    SHA512

                    e66d02e472a436ba2d9774f625f4af8d6a677b18a421262b250781858d0245cb0d6e758c00060336e8af1abd87749ead36d848586f5c0d56082824c4c64a3dda

                  • C:\Users\Admin\AppData\Local\Temp\svclip.exe

                    MD5

                    dc9dad5b0a3f2aa8c2056f300670d2fc

                    SHA1

                    0e804acc7f1048f1cd2b10234f0df7bfab7d8e74

                    SHA256

                    8d8701366f2def69b5887ebbfa3a5c2458a4c57b2fc17cf3a5f9769a5a77cd35

                    SHA512

                    e66d02e472a436ba2d9774f625f4af8d6a677b18a421262b250781858d0245cb0d6e758c00060336e8af1abd87749ead36d848586f5c0d56082824c4c64a3dda

                  • C:\Users\Admin\AppData\Local\Temp\tmpE8F9.tmp

                    MD5

                    25447faf170764cd57bd88770f87d850

                    SHA1

                    2c9f9c85c0eae12e7ba4e69c3edcdfe25dca1010

                    SHA256

                    1e6d1f20db5df22623b7e446a1dfc28c49d26ddc968a1892ea75f981e3117802

                    SHA512

                    9b06a192857bfe447c82577ce557a22109ecbdbda13e8a636f4a6d4f193c314826045375b2ad0fdfa8bed9f9fc001a4954a47a0b812ffe8a54aba19131968bc3

                  • memory/1064-114-0x0000000000F70000-0x0000000000F71000-memory.dmp

                  • memory/1064-120-0x0000000005D80000-0x0000000005D85000-memory.dmp

                  • memory/1064-121-0x0000000009070000-0x0000000009071000-memory.dmp

                  • memory/1064-122-0x00000000092C0000-0x0000000009367000-memory.dmp

                  • memory/1064-123-0x000000000B980000-0x000000000B9DB000-memory.dmp

                  • memory/1064-118-0x00000000058C0000-0x0000000005DBE000-memory.dmp

                  • memory/1064-116-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

                  • memory/1064-117-0x0000000005960000-0x0000000005961000-memory.dmp

                  • memory/1064-119-0x00000000058D0000-0x00000000058D1000-memory.dmp

                  • memory/1460-151-0x00000000087B0000-0x0000000008809000-memory.dmp

                  • memory/1460-150-0x0000000005230000-0x000000000572E000-memory.dmp

                  • memory/1460-143-0x00000000009B0000-0x00000000009B1000-memory.dmp

                  • memory/1460-152-0x000000000AF30000-0x000000000AF35000-memory.dmp

                  • memory/1460-140-0x0000000000000000-mapping.dmp

                  • memory/1928-153-0x0000000000000000-mapping.dmp

                  • memory/2192-133-0x00000000054B0000-0x0000000005AB6000-memory.dmp

                  • memory/2192-139-0x00000000070C0000-0x00000000070C1000-memory.dmp

                  • memory/2192-138-0x0000000007870000-0x0000000007871000-memory.dmp

                  • memory/2192-137-0x0000000007170000-0x0000000007171000-memory.dmp

                  • memory/2192-134-0x0000000005880000-0x0000000005881000-memory.dmp

                  • memory/2192-132-0x0000000005610000-0x0000000005611000-memory.dmp

                  • memory/2192-131-0x00000000055D0000-0x00000000055D1000-memory.dmp

                  • memory/2192-130-0x0000000005570000-0x0000000005571000-memory.dmp

                  • memory/2192-129-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

                  • memory/2192-125-0x000000000041654E-mapping.dmp

                  • memory/2192-124-0x0000000000400000-0x000000000041C000-memory.dmp

                  • memory/3288-156-0x000000000040403E-mapping.dmp

                  • memory/3288-155-0x0000000000400000-0x000000000040A000-memory.dmp

                  • memory/3288-162-0x0000000005590000-0x0000000005591000-memory.dmp