allcome | be1bc698d63cbfc97d75edaa1fe850772d1e082a7b9a24aa5e09ed5b3bdeedde

Resubmissions

25-12-2022 14:22

221225-rppf7abf39 10

25-12-2022 14:22

25-12-2022 14:21

25-12-2022 14:21

25-12-2022 14:13

Analysis

max time kernel
135s
max time network
138s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
25-12-2022 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Size

9.1MB
MD5

58ec0acfe4edcc15917b97ef91596f07
SHA1

60e610685d9a549926e7a9b0cb6bcc6509708d3c
SHA256

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02
SHA512

5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736
SSDEEP

196608:K2ejh9Qo2P3Cgnpmtw69DvGSfkDpVpyPc9izcM/WaQCf:Kd4CHx3IyP4izp+Uf

Score

10^/10

allcome evasion stealer themida trojan

Malware Config

Extracted

Family

allcome

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

Signatures

Allcome
A clipbanker that supports stealing different cryptocurrency wallets and payment forms.
stealer allcome

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe

Executes dropped EXE 1 IoCs

Processes:

MoUSO.exe

pid process

4844 MoUSO.exe

pid	process
4844	MoUSO.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exeMoUSO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2300-162-0x00000000012C0000-0x0000000001BDE000-memory.dmp	themida
behavioral1/memory/2300-163-0x00000000012C0000-0x0000000001BDE000-memory.dmp	themida
behavioral1/memory/2300-228-0x00000000012C0000-0x0000000001BDE000-memory.dmp	themida
behavioral1/memory/4140-282-0x00000000012C0000-0x0000000001BDE000-memory.dmp	themida
C:\Users\Admin\AppData\Local\cache\MoUSO.exe	themida
C:\Users\Admin\AppData\Local\cache\MoUSO.exe	themida
behavioral1/memory/4844-346-0x0000000000880000-0x000000000119E000-memory.dmp	themida
behavioral1/memory/4844-347-0x0000000000880000-0x000000000119E000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exeMoUSO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MoUSO.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe

description	pid	process	target process
PID 2300 set thread context of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4784 schtasks.exe

pid	process
4784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exeMoUSO.exe

pid	process
2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
4844	MoUSO.exe
4844	MoUSO.exe
4844	MoUSO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exeMoUSO.exe

description	pid	process
Token: SeDebugPrivilege	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Token: SeDebugPrivilege	4844	MoUSO.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe

description	pid	process	target process
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 2300 wrote to memory of 4140	2300	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
PID 4140 wrote to memory of 4784	4140	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	schtasks.exe
PID 4140 wrote to memory of 4784	4140	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	schtasks.exe
PID 4140 wrote to memory of 4784	4140	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
"C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
  "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4784

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\cache\MoUSO.exe

Filesize
9.1MB

MD5
58ec0acfe4edcc15917b97ef91596f07

SHA1
60e610685d9a549926e7a9b0cb6bcc6509708d3c

SHA256
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

SHA512
5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe

Filesize
9.1MB

MD5
58ec0acfe4edcc15917b97ef91596f07

SHA1
60e610685d9a549926e7a9b0cb6bcc6509708d3c

SHA256
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

SHA512
5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

Download Submit
memory/2300-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-126-0x00000000012C0000-0x0000000001BDE000-memory.dmp

Filesize
9.1MB

Download
memory/2300-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-149-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-150-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-162-0x00000000012C0000-0x0000000001BDE000-memory.dmp

Filesize
9.1MB

Download
memory/2300-163-0x00000000012C0000-0x0000000001BDE000-memory.dmp

Filesize
9.1MB

Download
memory/2300-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-166-0x0000000005C70000-0x0000000005D0C000-memory.dmp

Filesize
624KB

Download
memory/2300-167-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-175-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-180-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-181-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-182-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-183-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-184-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-185-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-186-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-188-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-187-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/2300-191-0x00000000012C0000-0x0000000001BDE000-memory.dmp

Filesize
9.1MB

Download
memory/2300-204-0x00000000067B0000-0x00000000067E0000-memory.dmp

Filesize
192KB

Download
memory/2300-205-0x0000000006880000-0x0000000006912000-memory.dmp

Filesize
584KB

Download
memory/2300-206-0x0000000006E20000-0x000000000731E000-memory.dmp

Filesize
5.0MB

Download
memory/2300-209-0x0000000006B20000-0x0000000006B2A000-memory.dmp

Filesize
40KB

Download
memory/2300-213-0x0000000006DF0000-0x0000000006E08000-memory.dmp

Filesize
96KB

Download
memory/2300-216-0x0000000009320000-0x000000000933A000-memory.dmp

Filesize
104KB

Download
memory/2300-217-0x0000000009340000-0x0000000009346000-memory.dmp

Filesize
24KB

Download
memory/2300-228-0x00000000012C0000-0x0000000001BDE000-memory.dmp

Filesize
9.1MB

Download
memory/4140-219-0x0000000000402DAA-mapping.dmp

Download
memory/4140-225-0x00000000012C0000-0x0000000001BDE000-memory.dmp

Filesize
9.1MB

Download
memory/4140-271-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4140-282-0x00000000012C0000-0x0000000001BDE000-memory.dmp

Filesize
9.1MB

Download
memory/4140-283-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4784-279-0x0000000000000000-mapping.dmp

Download
memory/4844-305-0x0000000000880000-0x000000000119E000-memory.dmp

Filesize
9.1MB

Download
memory/4844-346-0x0000000000880000-0x000000000119E000-memory.dmp

Filesize
9.1MB

Download
memory/4844-347-0x0000000000880000-0x000000000119E000-memory.dmp

Filesize
9.1MB

Download