Analysis
-
max time kernel
158s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe
-
Size
120KB
-
MD5
031d9264f4c5fb68ab00e9b820a5a869
-
SHA1
268c830c713756bd60a33f765f49e6207ab3d2e5
-
SHA256
d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158
-
SHA512
0bce0870090603f68c7f5e5902accaaf1b79afc5d13d983ac28881a3f4ce268fb3ea50594609333de96801b0400f8bea4cae25d8c9b2f364b55d8b06d2bc4c72
Malware Config
Extracted
Family
allcome
C2
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=Rachel
Wallets
DCbpjBAroXBj3jrvq8HRPAKd8wYPnBwwi7
rKewCaU4Q6gqJnb5nJqkDY69QoxHKXAJZi
Xiem2Rw5LULbzv6rM49FqKAKD1nHSxpjxb
TZ3Pn82NBECik8ujtc3Wu5AVsQLCdt7cG1
t1Pxn7QZPAVhrsd2cdPHDEjDR1jtwpoUvbT
GDKPOPZWADWVDB2B743X7Q5QIMXIFJTIJ3K3JTR5P2EKO22GJQRAZRKC
497qdSyfY8t9dYnAGTnk8UigUbUPL4MXTFAxobWPDZ5rReSiVNL22GEGt9ptgNbDbTe3qyj3oRq2LfEYbws8yGqnSjBWHR6
qra53qtr5kvaye7gvf5algrre5h0w6harqxluum6kp
bc1q79xgc502sqzt4qz0jhr7lr7qdxkf2z006gym0l
0x9bd5f03363CA0231A32b3B36ae2cf01623E2D1fE
LcPqsR8yyzukNBgoKrq3pKEXV4rpuMeF91
ronin:09864801afc2b70c960366f4c8ad806fe9d6965d
Signatures
-
suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1
suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1
-
Executes dropped EXE 2 IoCs
pid Process 388 subst.exe 3444 subst.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5028 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe 3444 subst.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4144 svchost.exe Token: SeCreatePagefilePrivilege 4144 svchost.exe Token: SeShutdownPrivilege 4144 svchost.exe Token: SeCreatePagefilePrivilege 4144 svchost.exe Token: SeShutdownPrivilege 4144 svchost.exe Token: SeCreatePagefilePrivilege 4144 svchost.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe Token: SeRestorePrivilege 3140 TiWorker.exe Token: SeSecurityPrivilege 3140 TiWorker.exe Token: SeBackupPrivilege 3140 TiWorker.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1516 wrote to memory of 5028 1516 d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe 82 PID 1516 wrote to memory of 5028 1516 d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe 82 PID 1516 wrote to memory of 5028 1516 d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe"C:\Users\Admin\AppData\Local\Temp\d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr C:\Users\Admin\AppData\Local\CrashDumps\subst.exe2⤵
- Creates scheduled task(s)
PID:5028
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
C:\Users\Admin\AppData\Local\CrashDumps\subst.exeC:\Users\Admin\AppData\Local\CrashDumps\subst.exe1⤵
- Executes dropped EXE
PID:388
-
C:\Users\Admin\AppData\Local\CrashDumps\subst.exeC:\Users\Admin\AppData\Local\CrashDumps\subst.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3444