Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    08-11-2021 16:51

General

  • Target

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe

  • Size

    834KB

  • MD5

    2c25a0926e5228d2205b3b8c8ef4d7f4

  • SHA1

    5f8a9d364dc3d03a5b11fd5be0629d0fb5a8c409

  • SHA256

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6

  • SHA512

    cafe8fae74d414015118b838b5e4b30183733d5e833c5db84a56bd2d5cf728cad08d2bbefbeadc86b15b7dbf6dc25fcabdffa8ff4fb346dc0f66376087a28468

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • Loads dropped DLL 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:868
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1812
    • C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
      "C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" sqlite.dll,global
        2⤵
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1424

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
      MD5

      bbd4ce7a3b397979f6725781367e2671

      SHA1

      1627f36916b4a3e2384a3aa2b0af35ba9e785093

      SHA256

      c13e0dd5f82062a4659f6fa989b00a2d109644156675aa63e7670288723a9fe4

      SHA512

      b0a5708673f3077eaad552ea664f16b569b653be55865221506b537b41c77ec9b5610d3f67b996e7f2da0bd08da274dc01c9e7db2ce1ed706c18812093d76b65

    • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

    • memory/588-55-0x0000000075E51000-0x0000000075E53000-memory.dmp
      Filesize

      8KB

    • memory/868-69-0x0000000000F10000-0x0000000000F82000-memory.dmp
      Filesize

      456KB

    • memory/868-68-0x00000000008D0000-0x000000000091D000-memory.dmp
      Filesize

      308KB

    • memory/1424-64-0x0000000001FA0000-0x00000000020A1000-memory.dmp
      Filesize

      1.0MB

    • memory/1424-67-0x0000000001C40000-0x0000000001C9D000-memory.dmp
      Filesize

      372KB

    • memory/1424-56-0x0000000000000000-mapping.dmp
    • memory/1812-66-0x00000000FFB3246C-mapping.dmp
    • memory/1812-70-0x0000000000360000-0x00000000003D2000-memory.dmp
      Filesize

      456KB

    • memory/1812-65-0x00000000000F0000-0x000000000013D000-memory.dmp
      Filesize

      308KB

    • memory/1812-71-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp
      Filesize

      8KB

    • memory/1812-72-0x00000000003E0000-0x00000000003FB000-memory.dmp
      Filesize

      108KB

    • memory/1812-73-0x0000000003140000-0x0000000003245000-memory.dmp
      Filesize

      1.0MB