Resubmissions

10-11-2021 14:50

211110-r7nbvaeddr 10

08-11-2021 16:12

211108-tnmmbahgaj 10

08-11-2021 15:26

211108-svdsbaccf6 10

08-11-2021 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    1811s
  • max time network
    1820s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    08-11-2021 16:12

General

  • Target

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe

Score
10/10

Malware Config

Signatures

  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
      PID:1340
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:736
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1608
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2924
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
        • Modifies registry class
        PID:2664
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          2⤵
            PID:3708
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2476
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2448
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1852
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1448
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1268
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1096
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:940
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:1008
                        • C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
                          "C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3808
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" sqlite.dll,global
                            2⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1280

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Discovery

                        System Information Discovery

                        2
                        T1082

                        Query Registry

                        1
                        T1012

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                          MD5

                          bbd4ce7a3b397979f6725781367e2671

                          SHA1

                          1627f36916b4a3e2384a3aa2b0af35ba9e785093

                          SHA256

                          c13e0dd5f82062a4659f6fa989b00a2d109644156675aa63e7670288723a9fe4

                          SHA512

                          b0a5708673f3077eaad552ea664f16b569b653be55865221506b537b41c77ec9b5610d3f67b996e7f2da0bd08da274dc01c9e7db2ce1ed706c18812093d76b65

                        • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                          MD5

                          d2c3e38d64273ea56d503bb3fb2a8b5d

                          SHA1

                          177da7d99381bbc83ede6b50357f53944240d862

                          SHA256

                          25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                          SHA512

                          2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                        • \Users\Admin\AppData\Local\Temp\sqlite.dll
                          MD5

                          d2c3e38d64273ea56d503bb3fb2a8b5d

                          SHA1

                          177da7d99381bbc83ede6b50357f53944240d862

                          SHA256

                          25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                          SHA512

                          2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                        • memory/736-175-0x0000018CCBEC0000-0x0000018CCBEC4000-memory.dmp
                          Filesize

                          16KB

                        • memory/736-146-0x0000018CCC140000-0x0000018CCC18D000-memory.dmp
                          Filesize

                          308KB

                        • memory/736-149-0x0000018CCC200000-0x0000018CCC272000-memory.dmp
                          Filesize

                          456KB

                        • memory/736-179-0x0000018CCBDD0000-0x0000018CCBDD4000-memory.dmp
                          Filesize

                          16KB

                        • memory/736-125-0x0000018CCBDC0000-0x0000018CCBDC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/736-126-0x0000018CCBDC0000-0x0000018CCBDC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/736-176-0x0000018CCBEB0000-0x0000018CCBEB1000-memory.dmp
                          Filesize

                          4KB

                        • memory/736-177-0x0000018CCBEB0000-0x0000018CCBEB4000-memory.dmp
                          Filesize

                          16KB

                        • memory/940-141-0x000001B1372C0000-0x000001B1372C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/940-185-0x000001B1372C0000-0x000001B1372C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/940-197-0x000001B138040000-0x000001B1380B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/940-162-0x000001B1379E0000-0x000001B137A52000-memory.dmp
                          Filesize

                          456KB

                        • memory/940-140-0x000001B1372C0000-0x000001B1372C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1008-181-0x000001A3E8AA0000-0x000001A3E8AA2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1008-154-0x000001A3E92A0000-0x000001A3E9312000-memory.dmp
                          Filesize

                          456KB

                        • memory/1008-133-0x000001A3E8AA0000-0x000001A3E8AA2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1008-193-0x000001A3E9320000-0x000001A3E9392000-memory.dmp
                          Filesize

                          456KB

                        • memory/1008-132-0x000001A3E8AA0000-0x000001A3E8AA2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1096-196-0x000002A85B170000-0x000002A85B1E2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1096-138-0x000002A85A180000-0x000002A85A182000-memory.dmp
                          Filesize

                          8KB

                        • memory/1096-160-0x000002A85AB00000-0x000002A85AB72000-memory.dmp
                          Filesize

                          456KB

                        • memory/1096-139-0x000002A85A180000-0x000002A85A182000-memory.dmp
                          Filesize

                          8KB

                        • memory/1096-184-0x000002A85A180000-0x000002A85A182000-memory.dmp
                          Filesize

                          8KB

                        • memory/1268-157-0x00000229048B0000-0x0000022904922000-memory.dmp
                          Filesize

                          456KB

                        • memory/1268-200-0x00000229049A0000-0x0000022904A12000-memory.dmp
                          Filesize

                          456KB

                        • memory/1268-188-0x0000022903B80000-0x0000022903B82000-memory.dmp
                          Filesize

                          8KB

                        • memory/1268-153-0x0000022903B80000-0x0000022903B82000-memory.dmp
                          Filesize

                          8KB

                        • memory/1268-155-0x0000022903B80000-0x0000022903B82000-memory.dmp
                          Filesize

                          8KB

                        • memory/1280-124-0x0000000004BF1000-0x0000000004CF2000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/1280-120-0x0000000000000000-mapping.dmp
                        • memory/1280-144-0x0000000003170000-0x00000000031CD000-memory.dmp
                          Filesize

                          372KB

                        • memory/1340-163-0x000002672B510000-0x000002672B582000-memory.dmp
                          Filesize

                          456KB

                        • memory/1340-189-0x000002672AFA0000-0x000002672AFA2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1340-159-0x000002672AFA0000-0x000002672AFA2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1340-201-0x000002672B590000-0x000002672B602000-memory.dmp
                          Filesize

                          456KB

                        • memory/1340-161-0x000002672AFA0000-0x000002672AFA2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1448-145-0x0000029E4E830000-0x0000029E4E8A2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1448-198-0x0000029E4EA70000-0x0000029E4EAE2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1448-143-0x0000029E4E090000-0x0000029E4E092000-memory.dmp
                          Filesize

                          8KB

                        • memory/1448-142-0x0000029E4E090000-0x0000029E4E092000-memory.dmp
                          Filesize

                          8KB

                        • memory/1448-186-0x0000029E4E090000-0x0000029E4E092000-memory.dmp
                          Filesize

                          8KB

                        • memory/1608-171-0x0000023B460C0000-0x0000023B460C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1608-152-0x0000023B46020000-0x0000023B46092000-memory.dmp
                          Filesize

                          456KB

                        • memory/1608-130-0x0000023B460C0000-0x0000023B460C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1608-131-0x0000023B460C0000-0x0000023B460C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1608-127-0x00007FF6343D4060-mapping.dmp
                        • memory/1608-170-0x0000023B460C0000-0x0000023B460C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1608-172-0x0000023B47A50000-0x0000023B47A6B000-memory.dmp
                          Filesize

                          108KB

                        • memory/1608-173-0x0000023B48900000-0x0000023B48A05000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/1852-147-0x000001E16A510000-0x000001E16A512000-memory.dmp
                          Filesize

                          8KB

                        • memory/1852-148-0x000001E16A510000-0x000001E16A512000-memory.dmp
                          Filesize

                          8KB

                        • memory/1852-150-0x000001E16AE40000-0x000001E16AEB2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1852-187-0x000001E16A510000-0x000001E16A512000-memory.dmp
                          Filesize

                          8KB

                        • memory/1852-199-0x000001E16AEC0000-0x000001E16AF32000-memory.dmp
                          Filesize

                          456KB

                        • memory/2448-182-0x000001E85E2F0000-0x000001E85E2F2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2448-156-0x000001E85EB90000-0x000001E85EC02000-memory.dmp
                          Filesize

                          456KB

                        • memory/2448-134-0x000001E85E2F0000-0x000001E85E2F2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2448-135-0x000001E85E2F0000-0x000001E85E2F2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2448-194-0x000001E85EC40000-0x000001E85ECB2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2476-183-0x00000220C85B0000-0x00000220C85B2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2476-158-0x00000220C8E20000-0x00000220C8E92000-memory.dmp
                          Filesize

                          456KB

                        • memory/2476-136-0x00000220C85B0000-0x00000220C85B2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2476-195-0x00000220C9340000-0x00000220C93B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2476-137-0x00000220C85B0000-0x00000220C85B2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2656-168-0x0000028A3DD40000-0x0000028A3DDB2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2656-164-0x0000028A3CDF0000-0x0000028A3CDF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2656-165-0x0000028A3CDF0000-0x0000028A3CDF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2656-202-0x0000028A3E3A0000-0x0000028A3E412000-memory.dmp
                          Filesize

                          456KB

                        • memory/2656-190-0x0000028A3CDF0000-0x0000028A3CDF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2664-166-0x000001EE73F90000-0x000001EE73F92000-memory.dmp
                          Filesize

                          8KB

                        • memory/2664-191-0x000001EE73F90000-0x000001EE73F92000-memory.dmp
                          Filesize

                          8KB

                        • memory/2664-169-0x000001EE74820000-0x000001EE74892000-memory.dmp
                          Filesize

                          456KB

                        • memory/2664-167-0x000001EE73F90000-0x000001EE73F92000-memory.dmp
                          Filesize

                          8KB

                        • memory/2664-203-0x000001EE74980000-0x000001EE749F2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2924-180-0x00000185FDFE0000-0x00000185FDFE2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2924-151-0x00000185FE900000-0x00000185FE972000-memory.dmp
                          Filesize

                          456KB

                        • memory/2924-192-0x00000185FECC0000-0x00000185FED32000-memory.dmp
                          Filesize

                          456KB

                        • memory/2924-128-0x00000185FDFE0000-0x00000185FDFE2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2924-129-0x00000185FDFE0000-0x00000185FDFE2000-memory.dmp
                          Filesize

                          8KB

                        • memory/3708-174-0x0000000000000000-mapping.dmp
                        • memory/3808-118-0x0000000002660000-0x0000000002661000-memory.dmp
                          Filesize

                          4KB

                        • memory/3808-119-0x0000000002660000-0x0000000002661000-memory.dmp
                          Filesize

                          4KB