Resubmissions

10-11-2021 14:50

211110-r7nbvaeddr 10

08-11-2021 16:12

211108-tnmmbahgaj 10

08-11-2021 15:26

211108-svdsbaccf6 10

08-11-2021 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    08-11-2021 14:48

General

  • Target

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe

  • Size

    834KB

  • MD5

    2c25a0926e5228d2205b3b8c8ef4d7f4

  • SHA1

    5f8a9d364dc3d03a5b11fd5be0629d0fb5a8c409

  • SHA256

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6

  • SHA512

    cafe8fae74d414015118b838b5e4b30183733d5e833c5db84a56bd2d5cf728cad08d2bbefbeadc86b15b7dbf6dc25fcabdffa8ff4fb346dc0f66376087a28468

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • Loads dropped DLL 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:880
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1700
    • C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
      "C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" sqlite.dll,global
        2⤵
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1664

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
      MD5

      bbd4ce7a3b397979f6725781367e2671

      SHA1

      1627f36916b4a3e2384a3aa2b0af35ba9e785093

      SHA256

      c13e0dd5f82062a4659f6fa989b00a2d109644156675aa63e7670288723a9fe4

      SHA512

      b0a5708673f3077eaad552ea664f16b569b653be55865221506b537b41c77ec9b5610d3f67b996e7f2da0bd08da274dc01c9e7db2ce1ed706c18812093d76b65

    • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • memory/880-68-0x00000000007B0000-0x00000000007FD000-memory.dmp
      Filesize

      308KB

    • memory/880-69-0x0000000000FF0000-0x0000000001062000-memory.dmp
      Filesize

      456KB

    • memory/1380-55-0x0000000074E51000-0x0000000074E53000-memory.dmp
      Filesize

      8KB

    • memory/1664-56-0x0000000000000000-mapping.dmp
    • memory/1664-66-0x0000000001F00000-0x0000000002001000-memory.dmp
      Filesize

      1.0MB

    • memory/1664-67-0x0000000001E00000-0x0000000001E5D000-memory.dmp
      Filesize

      372KB

    • memory/1700-64-0x0000000000060000-0x00000000000AD000-memory.dmp
      Filesize

      308KB

    • memory/1700-65-0x00000000FFC5246C-mapping.dmp
    • memory/1700-70-0x0000000000430000-0x00000000004A2000-memory.dmp
      Filesize

      456KB

    • memory/1700-71-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
      Filesize

      8KB

    • memory/1700-72-0x00000000004F0000-0x000000000050B000-memory.dmp
      Filesize

      108KB

    • memory/1700-73-0x0000000003070000-0x0000000003175000-memory.dmp
      Filesize

      1.0MB