Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-10-2022 21:36

General

  • Target

    bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe

  • Size

    871KB

  • MD5

    8dcec334c74becd217f0f61c53a45a54

  • SHA1

    02a178c1bdd24a780c491c2efe1dcf6bb6be13f7

  • SHA256

    bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b

  • SHA512

    bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695

  • SSDEEP

    12288:q39riVwf3iJ+HN3TF4W7Wba0WGU68RnAgqgNYEgeGEKDBjs2sd0psmCA+Pdm7Y7a:qNriy/fTFOzgCGTjUDn/MI9d

Score
10/10

Malware Config

Extracted

Family

allcome

C2

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

Signatures

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe
    "C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe
      "C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"
      2⤵
        PID:3808
      • C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe
        "C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"
        2⤵
          PID:2604
        • C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe
          "C:\Users\Admin\AppData\Local\Temp\bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
            3⤵
            • Creates scheduled task(s)
            PID:4640
      • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
        C:\Users\Admin\AppData\Local\cache\MoUSO.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4720
        • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
          "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
          2⤵
          • Executes dropped EXE
          PID:2260
        • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
          "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
          2⤵
            PID:3212

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Discovery

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
          Filesize

          871KB

          MD5

          8dcec334c74becd217f0f61c53a45a54

          SHA1

          02a178c1bdd24a780c491c2efe1dcf6bb6be13f7

          SHA256

          bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b

          SHA512

          bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695

        • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
          Filesize

          871KB

          MD5

          8dcec334c74becd217f0f61c53a45a54

          SHA1

          02a178c1bdd24a780c491c2efe1dcf6bb6be13f7

          SHA256

          bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b

          SHA512

          bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695

        • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
          Filesize

          871KB

          MD5

          8dcec334c74becd217f0f61c53a45a54

          SHA1

          02a178c1bdd24a780c491c2efe1dcf6bb6be13f7

          SHA256

          bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b

          SHA512

          bf8b6f0043aa222be36c4c6816a95a62a8cc17bbee4454d110d590e2bde7e3ca60504cae01196cf6a2a31f92dd874517fde082dfa505a394b2bf2bbda3a76695

        • memory/2896-116-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-117-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-118-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-119-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-120-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-121-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-122-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-123-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-124-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-125-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-126-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-127-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-128-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-129-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-130-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-131-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-132-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-133-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-134-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-135-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-136-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-137-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-138-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-139-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-140-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-142-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-141-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-143-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-144-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-145-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-146-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-147-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-148-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-149-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-150-0x00000000010C0000-0x000000000119E000-memory.dmp
          Filesize

          888KB

        • memory/2896-151-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-152-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-153-0x00000000054A0000-0x000000000553C000-memory.dmp
          Filesize

          624KB

        • memory/2896-154-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-155-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-156-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-157-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-158-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-159-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-160-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-161-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-162-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-163-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-164-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-165-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-166-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-167-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-168-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-169-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-170-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-171-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-172-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-173-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-174-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-175-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-177-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-176-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-178-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-179-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-180-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-181-0x00000000779D0000-0x0000000077B5E000-memory.dmp
          Filesize

          1MB

        • memory/2896-196-0x0000000005F50000-0x0000000005F80000-memory.dmp
          Filesize

          192KB

        • memory/2896-197-0x0000000006490000-0x000000000698E000-memory.dmp
          Filesize

          4MB

        • memory/2896-198-0x0000000006090000-0x0000000006122000-memory.dmp
          Filesize

          584KB

        • memory/2896-201-0x0000000006070000-0x000000000607A000-memory.dmp
          Filesize

          40KB

        • memory/2896-205-0x0000000008600000-0x0000000008618000-memory.dmp
          Filesize

          96KB

        • memory/2896-208-0x0000000008980000-0x000000000899A000-memory.dmp
          Filesize

          104KB

        • memory/2896-209-0x000000000B0D0000-0x000000000B0D6000-memory.dmp
          Filesize

          24KB

        • memory/4512-211-0x0000000000402DAA-mapping.dmp
        • memory/4512-266-0x0000000000400000-0x0000000000423000-memory.dmp
          Filesize

          140KB

        • memory/4512-287-0x0000000000400000-0x0000000000423000-memory.dmp
          Filesize

          140KB

        • memory/4640-284-0x0000000000000000-mapping.dmp
        • memory/4720-342-0x0000000000B20000-0x0000000000BFE000-memory.dmp
          Filesize

          888KB