Analysis
-
max time kernel
160s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe
-
Size
120KB
-
MD5
e5d69699bde3b15ff93d21c5b673bd8a
-
SHA1
7407968eb3d942ebabee4b432df4c4a9ac96c3e3
-
SHA256
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4
-
SHA512
46312be3e25e994e56e92869ea93a2452a149d0c04fb9067f13412f5d5f527597ec1c62a2c682d93a6d84f8b9065c21713177056f6853427853bdf9aa4038121
Malware Config
Extracted
Family
allcome
C2
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=Class1c228
Wallets
D92TTxkBTyJfavHWmAJfHpZRLeUY9ReHvf
rEtKYAu1Pwa9ydAB9YfXrTgVTtwB7QAghY
0x4aab8F9FFFE07459b1365A10405a4Fe7Aa7F1f81
XeZnNrJyBV3NimCP61bnJK8EYEqe984rn8
t1Vrj6CU9hHRwiuoSWDhgwtRhmPxRu9MqXs
GBEARLBYJHWXMY7AFAGF7VGMRMRK2D5HSRADSABSPMRIW6XPDQBRQSMI
0x43B091611E359447bAC8b2aE1619424A8417De38
qqvqg5fjmjjkd6egvwxv5et63jpakdqvuq3ye335x0
bc1qrzlvgv39ynr32vzacpg8y4y4yklmr370sxwqj3
0x4aab8F9FFFE07459b1365A10405a4Fe7Aa7F1f81
ltc1qef2n5uu37e34nvtrfhnurdj9lc574h90grpa0e
380990138409
Signatures
-
suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1
suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1
-
Executes dropped EXE 1 IoCs
pid Process 4608 subst.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 552 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe 4608 subst.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4860 svchost.exe Token: SeCreatePagefilePrivilege 4860 svchost.exe Token: SeShutdownPrivilege 4860 svchost.exe Token: SeCreatePagefilePrivilege 4860 svchost.exe Token: SeShutdownPrivilege 4860 svchost.exe Token: SeCreatePagefilePrivilege 4860 svchost.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe Token: SeRestorePrivilege 1904 TiWorker.exe Token: SeSecurityPrivilege 1904 TiWorker.exe Token: SeBackupPrivilege 1904 TiWorker.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3372 wrote to memory of 552 3372 d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe 82 PID 3372 wrote to memory of 552 3372 d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe 82 PID 3372 wrote to memory of 552 3372 d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe"C:\Users\Admin\AppData\Local\Temp\d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr C:\Users\Admin\AppData\Local\CrashDumps\subst.exe2⤵
- Creates scheduled task(s)
PID:552
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
C:\Users\Admin\AppData\Local\CrashDumps\subst.exeC:\Users\Admin\AppData\Local\CrashDumps\subst.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4608