Analysis

  • max time kernel
    165s
  • max time network
    177s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    08-11-2021 10:07

General

  • Target

    ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83.exe

  • Size

    89KB

  • MD5

    a56c80f6cef4b2466024b6af88123183

  • SHA1

    7d8d3a50f5b1239736423dbb0b1226d59bd1988a

  • SHA256

    ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83

  • SHA512

    11c26244e282d37c7587a5838624bd2f310a0842add9fde6abb8150138e5d190438cc54e4e2df1d1985fc453600207d9f35effa290748ef05418534131128cd3

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 16 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3784
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:3300
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2648
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /F /T /R
        2⤵
          PID:3356
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2544
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2404
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2348
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1892
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1424
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1260
                  • C:\Users\Admin\AppData\Local\Temp\ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83.exe
                    "C:\Users\Admin\AppData\Local\Temp\ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83.exe"
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3356
                    • C:\Users\Admin\AppData\Local\Temp\ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83.exe
                      "C:\Users\Admin\AppData\Local\Temp\ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83.exe" -u
                      2⤵
                        PID:1032
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Themes
                      1⤵
                        PID:1224
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                        1⤵
                          PID:1092
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                          1⤵
                            PID:928
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                            1⤵
                              PID:296
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              1⤵
                              • Process spawned unexpected child process
                              • Suspicious use of WriteProcessMemory
                              PID:1288
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                2⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:1736

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Discovery

                            System Information Discovery

                            2
                            T1082

                            Query Registry

                            1
                            T1012

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                              MD5

                              a9c37fb49420d705591e205757192f80

                              SHA1

                              5ab4f43417052eb6f2ae2adbf0cdfdb3daa9fe63

                              SHA256

                              ae69ec2a1f200fc59d99c17ebe730fb8c9664570ecc221f28633f8622e0d4ca7

                              SHA512

                              962f0a3d05147950a3d783dd9e04e80f4c3c6931f2fd0c7f6ed4c06046144f345e59f65d567f59ef2f3812d524fed2a1b0124fc9b207d54e5f965ed00e5d0e28

                            • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                              MD5

                              d2c3e38d64273ea56d503bb3fb2a8b5d

                              SHA1

                              177da7d99381bbc83ede6b50357f53944240d862

                              SHA256

                              25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                              SHA512

                              2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                            • \Users\Admin\AppData\Local\Temp\sqlite.dll
                              MD5

                              d2c3e38d64273ea56d503bb3fb2a8b5d

                              SHA1

                              177da7d99381bbc83ede6b50357f53944240d862

                              SHA256

                              25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                              SHA512

                              2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                            • memory/296-151-0x00000180AE080000-0x00000180AE0F2000-memory.dmp
                              Filesize

                              456KB

                            • memory/296-133-0x00000180AD9E0000-0x00000180AD9E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/296-132-0x00000180AD9E0000-0x00000180AD9E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/928-140-0x0000016C314E0000-0x0000016C314E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/928-143-0x0000016C31F40000-0x0000016C31FB2000-memory.dmp
                              Filesize

                              456KB

                            • memory/928-141-0x0000016C314E0000-0x0000016C314E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1032-118-0x0000000000000000-mapping.dmp
                            • memory/1092-158-0x000001C95D030000-0x000001C95D0A2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1092-139-0x000001C95C6F0000-0x000001C95C6F2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1092-138-0x000001C95C6F0000-0x000001C95C6F2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1224-157-0x0000023476E10000-0x0000023476E12000-memory.dmp
                              Filesize

                              8KB

                            • memory/1224-155-0x0000023476E10000-0x0000023476E12000-memory.dmp
                              Filesize

                              8KB

                            • memory/1224-159-0x0000023477130000-0x00000234771A2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1260-160-0x0000028D686A0000-0x0000028D686A2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1260-166-0x0000028D68C70000-0x0000028D68CE2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1260-161-0x0000028D686A0000-0x0000028D686A2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1424-145-0x00000230F69E0000-0x00000230F69E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1424-146-0x00000230F69E0000-0x00000230F69E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1424-149-0x00000230F7080000-0x00000230F70F2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1736-124-0x00000000045D0000-0x000000000462D000-memory.dmp
                              Filesize

                              372KB

                            • memory/1736-120-0x0000000000000000-mapping.dmp
                            • memory/1736-123-0x00000000044C5000-0x00000000045C6000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/1892-150-0x000001FAFB520000-0x000001FAFB522000-memory.dmp
                              Filesize

                              8KB

                            • memory/1892-154-0x000001FAFC340000-0x000001FAFC3B2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1892-152-0x000001FAFB520000-0x000001FAFB522000-memory.dmp
                              Filesize

                              8KB

                            • memory/2348-137-0x000001D0630D0000-0x000001D0630D2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2348-156-0x000001D0635B0000-0x000001D063622000-memory.dmp
                              Filesize

                              456KB

                            • memory/2348-136-0x000001D0630D0000-0x000001D0630D2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2404-134-0x000001CF636F0000-0x000001CF636F2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2404-135-0x000001CF636F0000-0x000001CF636F2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2404-153-0x000001CF63E80000-0x000001CF63EF2000-memory.dmp
                              Filesize

                              456KB

                            • memory/2544-129-0x000001462C310000-0x000001462C312000-memory.dmp
                              Filesize

                              8KB

                            • memory/2544-147-0x000001462CD00000-0x000001462CD72000-memory.dmp
                              Filesize

                              456KB

                            • memory/2544-128-0x000001462C310000-0x000001462C312000-memory.dmp
                              Filesize

                              8KB

                            • memory/2632-162-0x000001AF580C0000-0x000001AF580C2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2632-163-0x000001AF580C0000-0x000001AF580C2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2632-167-0x000001AF58900000-0x000001AF58972000-memory.dmp
                              Filesize

                              456KB

                            • memory/2648-168-0x0000012A71A00000-0x0000012A71A72000-memory.dmp
                              Filesize

                              456KB

                            • memory/2648-165-0x0000012A71280000-0x0000012A71282000-memory.dmp
                              Filesize

                              8KB

                            • memory/2648-164-0x0000012A71280000-0x0000012A71282000-memory.dmp
                              Filesize

                              8KB

                            • memory/3300-130-0x000001F5DBFC0000-0x000001F5DBFC2000-memory.dmp
                              Filesize

                              8KB

                            • memory/3300-148-0x000001F5DC170000-0x000001F5DC1E2000-memory.dmp
                              Filesize

                              456KB

                            • memory/3300-127-0x00007FF6F7924060-mapping.dmp
                            • memory/3300-131-0x000001F5DBFC0000-0x000001F5DBFC2000-memory.dmp
                              Filesize

                              8KB

                            • memory/3300-169-0x000001F5DBFC0000-0x000001F5DBFC2000-memory.dmp
                              Filesize

                              8KB

                            • memory/3300-170-0x000001F5DBFC0000-0x000001F5DBFC2000-memory.dmp
                              Filesize

                              8KB

                            • memory/3300-171-0x000001F5DDA20000-0x000001F5DDA3B000-memory.dmp
                              Filesize

                              108KB

                            • memory/3300-172-0x000001F5DE900000-0x000001F5DEA05000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/3356-173-0x0000000000000000-mapping.dmp
                            • memory/3784-144-0x000001BAFF210000-0x000001BAFF282000-memory.dmp
                              Filesize

                              456KB

                            • memory/3784-142-0x000001BAFEEA0000-0x000001BAFEEED000-memory.dmp
                              Filesize

                              308KB

                            • memory/3784-126-0x000001BAFEEF0000-0x000001BAFEEF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/3784-125-0x000001BAFEEF0000-0x000001BAFEEF2000-memory.dmp
                              Filesize

                              8KB