Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe
Resource
win7-en-20211208
General
-
Target
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe
-
Size
120KB
-
MD5
8950fcf3617883788286cc40cc8665f5
-
SHA1
b169be225703daefcf7d236893ae55b5cc774dbd
-
SHA256
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
-
SHA512
ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=infected
DJTEj1dHbvRbzRMFswkBbEoVtYyDX4utrm
r9ZdXujmStGh4xJ45FXAYiz6vLeF12ft4H
GBPA3M5TJHPBUY33MFFNTSFHGQEV27P2SP7NCGK5ZZXINCNMXFYO4C5L
48J7NrfRFCPFfwyHaywQUSKuyn56or1kRByicvx2ZCFMRboGDmvxH9y4kQz6T2Hhv8AREnZE4dS43JoVcrkc4kShNTkXbv8
qp4cn8t095hphpy6qraafmtsfskjnnxevcvvug8e87
bc1q2phs6h42kfecv9eu2vm9qjspmtw8w0256eg8cc
0x7942b7173F1557F285666009006Bff1AEe1339B3
LdCE37gd4AgqxAyjMjc4NYdZNT2nn1qpen
Signatures
-
suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1
suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1
-
Executes dropped EXE 3 IoCs
Processes:
subst.exesubst.exesubst.exepid Process 1488 subst.exe 1516 subst.exe 596 subst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exetaskeng.exedescription pid Process procid_target PID 1084 wrote to memory of 1928 1084 fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe 27 PID 1084 wrote to memory of 1928 1084 fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe 27 PID 1084 wrote to memory of 1928 1084 fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe 27 PID 1084 wrote to memory of 1928 1084 fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe 27 PID 1340 wrote to memory of 1488 1340 taskeng.exe 30 PID 1340 wrote to memory of 1488 1340 taskeng.exe 30 PID 1340 wrote to memory of 1488 1340 taskeng.exe 30 PID 1340 wrote to memory of 1488 1340 taskeng.exe 30 PID 1340 wrote to memory of 1516 1340 taskeng.exe 35 PID 1340 wrote to memory of 1516 1340 taskeng.exe 35 PID 1340 wrote to memory of 1516 1340 taskeng.exe 35 PID 1340 wrote to memory of 1516 1340 taskeng.exe 35 PID 1340 wrote to memory of 596 1340 taskeng.exe 36 PID 1340 wrote to memory of 596 1340 taskeng.exe 36 PID 1340 wrote to memory of 596 1340 taskeng.exe 36 PID 1340 wrote to memory of 596 1340 taskeng.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe"C:\Users\Admin\AppData\Local\Temp\fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr C:\Users\Admin\AppData\Local\CrashDumps\subst.exe2⤵
- Creates scheduled task(s)
PID:1928
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C4BB6F43-1876-46CD-BA17-BD514FE2278C} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\CrashDumps\subst.exeC:\Users\Admin\AppData\Local\CrashDumps\subst.exe2⤵
- Executes dropped EXE
PID:1488
-
-
C:\Users\Admin\AppData\Local\CrashDumps\subst.exeC:\Users\Admin\AppData\Local\CrashDumps\subst.exe2⤵
- Executes dropped EXE
PID:1516
-
-
C:\Users\Admin\AppData\Local\CrashDumps\subst.exeC:\Users\Admin\AppData\Local\CrashDumps\subst.exe2⤵
- Executes dropped EXE
PID:596
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8950fcf3617883788286cc40cc8665f5
SHA1b169be225703daefcf7d236893ae55b5cc774dbd
SHA256fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
SHA512ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3
-
MD5
8950fcf3617883788286cc40cc8665f5
SHA1b169be225703daefcf7d236893ae55b5cc774dbd
SHA256fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
SHA512ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3
-
MD5
8950fcf3617883788286cc40cc8665f5
SHA1b169be225703daefcf7d236893ae55b5cc774dbd
SHA256fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
SHA512ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3
-
MD5
8950fcf3617883788286cc40cc8665f5
SHA1b169be225703daefcf7d236893ae55b5cc774dbd
SHA256fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
SHA512ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\exp[1].php
MD5336d5ebc5436534e61d16e63ddfca327
SHA13bc15c8aae3e4124dd409035f32ea2fd6835efc9
SHA2563973e022e93220f9212c18d0d0c543ae7c309e46640da93a4a0314de999f5112
SHA5127c0b0d99a6e4c33cda0f6f63547f878f4dd9f486dfe5d0446ce004b1c0ff28f191ff86f5d5933d3614cceee6fbbdc17e658881d3a164dfa5d6f4c699b2126e3d
-
MD5
05cb8eda501cb2b71ae39b16de72cb3d
SHA1f9bfcabce9884e6a20e10720018d3425d5a59913
SHA256e23f34a4f328fdeb61c1259a04cb12de1963c7fde8bfc179e2ac9395b9f7eeaf
SHA512aa011c9baa1d6a6c687898fdcb8dabdc7027c6cf007839084a725abe4e760bae53d482412b1520a2217381e344a9591e93729298495799e757bc69a814f60f3f