Resubmissions

25-12-2022 14:22

221225-rppf7abf39 10

25-12-2022 14:22

221225-rpkg8seg4s 10

25-12-2022 14:21

221225-rpexraeg31 10

25-12-2022 14:21

221225-rn92haeg3z 10

25-12-2022 14:13

221225-rjx65seg3w 10

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-12-2022 14:13

General

  • Target

    95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe

  • Size

    850KB

  • MD5

    f183d934a954fc80602a9173f55f22c9

  • SHA1

    a472c526f1dec0eb9bccdf2e083171a176faf1c4

  • SHA256

    95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57

  • SHA512

    48d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24

  • SSDEEP

    12288:jYmzPxoepv5EUOPri4BTVUDnV89SxP3ol8VU9o:/xoS6TjUDnlP3G9o

Score
10/10

Malware Config

Extracted

Family

allcome

C2

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

Signatures

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
    "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
      "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
      2⤵
        PID:4132
      • C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
        "C:\Users\Admin\AppData\Local\Temp\95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
          3⤵
          • Creates scheduled task(s)
          PID:2344
    • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
      C:\Users\Admin\AppData\Local\cache\MoUSO.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
        "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
        2⤵
        • Executes dropped EXE
        PID:868
      • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
        "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
        2⤵
          PID:4876

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\cache\MoUSO.exe

        Filesize

        850KB

        MD5

        f183d934a954fc80602a9173f55f22c9

        SHA1

        a472c526f1dec0eb9bccdf2e083171a176faf1c4

        SHA256

        95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57

        SHA512

        48d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24

      • C:\Users\Admin\AppData\Local\cache\MoUSO.exe

        Filesize

        850KB

        MD5

        f183d934a954fc80602a9173f55f22c9

        SHA1

        a472c526f1dec0eb9bccdf2e083171a176faf1c4

        SHA256

        95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57

        SHA512

        48d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24

      • C:\Users\Admin\AppData\Local\cache\MoUSO.exe

        Filesize

        850KB

        MD5

        f183d934a954fc80602a9173f55f22c9

        SHA1

        a472c526f1dec0eb9bccdf2e083171a176faf1c4

        SHA256

        95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57

        SHA512

        48d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24

      • memory/3392-269-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/4064-325-0x0000000000B90000-0x0000000000C6A000-memory.dmp

        Filesize

        872KB

      • memory/5004-150-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-200-0x0000000005870000-0x000000000587A000-memory.dmp

        Filesize

        40KB

      • memory/5004-119-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-120-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-121-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-153-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-123-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-124-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-125-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-126-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-127-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-128-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-129-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-130-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-131-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-132-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-133-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-134-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-135-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-136-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-137-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-138-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-139-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-140-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-141-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-142-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-143-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-144-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-145-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-146-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-147-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-148-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-149-0x0000000001240000-0x000000000131A000-memory.dmp

        Filesize

        872KB

      • memory/5004-117-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-151-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-152-0x0000000004C60000-0x0000000004CFC000-memory.dmp

        Filesize

        624KB

      • memory/5004-122-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-118-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-158-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-156-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-157-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-155-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-159-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-160-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-161-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-162-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-163-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-164-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-165-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-166-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-167-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-168-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-169-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-170-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-171-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-172-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-173-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-174-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-175-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-176-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-177-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-178-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-179-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-180-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-195-0x0000000001210000-0x0000000001240000-memory.dmp

        Filesize

        192KB

      • memory/5004-196-0x0000000005CC0000-0x00000000061BE000-memory.dmp

        Filesize

        5.0MB

      • memory/5004-116-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-115-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-197-0x00000000058A0000-0x0000000005932000-memory.dmp

        Filesize

        584KB

      • memory/5004-154-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

        Filesize

        1.6MB

      • memory/5004-204-0x0000000007E00000-0x0000000007E18000-memory.dmp

        Filesize

        96KB

      • memory/5004-207-0x0000000008190000-0x00000000081AA000-memory.dmp

        Filesize

        104KB

      • memory/5004-208-0x000000000A8C0000-0x000000000A8C6000-memory.dmp

        Filesize

        24KB