Overview

overview

10

Static

static

10

f04444ba33...2f.exe

windows7_x64

10

f04444ba33...2f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    157s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    16-02-2022 12:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f04444ba33a73f6fa9770d0330cc489bf8b919f6c3342b66e3f423894ea22f2f.exe

  • Size

    120KB

  • MD5

    40b3c1644d3bd1702fdde6eb08f961d2

  • SHA1

    b6ae788abe3a524910bf2353dd55ab0fe831a7b2

  • SHA256

    f04444ba33a73f6fa9770d0330cc489bf8b919f6c3342b66e3f423894ea22f2f

  • SHA512

    85b2fedab47670714df9773ce9a6c2bf6701483a208aef087ed483f8b202b8ff04d4fcbada0fca63f668e60082fd226c4038138f46cdc3efee0093ccb286783d

Score
10/10
allcomestealersuricata

Malware Config

Extracted

Family

allcome

C2

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=budprosche

Wallets

DAiQQwrXqMvJh7dmrAf1juGVUPYoVhGMmb

rJCGM2bkktXaV3GvJhJnSnUnRGjSVRe3Qi

XoHHtksivtoG6B7ACT553QZfA8L294kLtL

TA5Tw8JpE2KyLgKogiC8ztyZ5AzSr22uW8

t1d2iYaHeeEHLs1UbVV7KsyZYvcP7HxcMYx

GAL35I3GVOD3IC34MBQ25L3QVMV54TYYSUGUSLGVWZXQONE5B5HLLR42

46Z2LbxsLB7Gijdo5TTpMdYssc9zLBC1k7MRjqZ7WT6tEycgiXF34SoTtyzdc29Ew8KSKUQMhuDmZf5Suv2Ft8Ke9aQr6db

qquysdz00zartzyrzufkzq2l3jv9gayyz5srqvfzcq

bc1qmvhlgeav49kw20lfejscgsd94rp3pkqt5c3fu4

0xcA4aeC6159a691d2FC5e8970F4c822554EcD4567

LX8V72paGcQgYNDhv4cJgEqCUF8WgEQf7Y

ronin:3d6be72d8f836295c22889b5da5b485d4fa6a44e

Signatures

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome
  • suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f04444ba33a73f6fa9770d0330cc489bf8b919f6c3342b66e3f423894ea22f2f.exe
    "C:\Users\Admin\AppData\Local\Temp\f04444ba33a73f6fa9770d0330cc489bf8b919f6c3342b66e3f423894ea22f2f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
      2⤵
      • Creates scheduled task(s)
      PID:3612
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1404
  • C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
    C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:4496
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
    MD5

    40b3c1644d3bd1702fdde6eb08f961d2

    SHA1

    b6ae788abe3a524910bf2353dd55ab0fe831a7b2

    SHA256

    f04444ba33a73f6fa9770d0330cc489bf8b919f6c3342b66e3f423894ea22f2f

    SHA512

    85b2fedab47670714df9773ce9a6c2bf6701483a208aef087ed483f8b202b8ff04d4fcbada0fca63f668e60082fd226c4038138f46cdc3efee0093ccb286783d

    Download Submit
  • C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
    MD5

    40b3c1644d3bd1702fdde6eb08f961d2

    SHA1

    b6ae788abe3a524910bf2353dd55ab0fe831a7b2

    SHA256

    f04444ba33a73f6fa9770d0330cc489bf8b919f6c3342b66e3f423894ea22f2f

    SHA512

    85b2fedab47670714df9773ce9a6c2bf6701483a208aef087ed483f8b202b8ff04d4fcbada0fca63f668e60082fd226c4038138f46cdc3efee0093ccb286783d

    Download Submit
  • memory/1404-130-0x000001B5B3C20000-0x000001B5B3C30000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1404-131-0x000001B5B3C80000-0x000001B5B3C90000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1404-132-0x000001B5B6330000-0x000001B5B6334000-memory.dmp
    Filesize

    16KB

    Download