allcome | be1bc698d63cbfc97d75edaa1fe850772d1e082a7b9a24aa5e09ed5b3bdeedde

Resubmissions

25-12-2022 14:22

221225-rppf7abf39 10

25-12-2022 14:22

25-12-2022 14:21

25-12-2022 14:21

25-12-2022 14:13

Analysis

max time kernel
126s
max time network
128s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
25-12-2022 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Size

9.1MB
MD5

58ec0acfe4edcc15917b97ef91596f07
SHA1

60e610685d9a549926e7a9b0cb6bcc6509708d3c
SHA256

2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02
SHA512

5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736
SSDEEP

196608:K2ejh9Qo2P3Cgnpmtw69DvGSfkDpVpyPc9izcM/WaQCf:Kd4CHx3IyP4izp+Uf

Score

10^/10

allcome evasion stealer themida trojan

Malware Config

Extracted

Family

allcome

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

Signatures

Allcome
A clipbanker that supports stealing different cryptocurrency wallets and payment forms.
stealer allcome

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe

Executes dropped EXE 1 IoCs

pid	Process
2544	MoUSO.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4248-161-0x0000000000F90000-0x00000000018AE000-memory.dmp	themida
behavioral1/memory/4248-162-0x0000000000F90000-0x00000000018AE000-memory.dmp	themida
behavioral1/memory/4136-216-0x0000000000F90000-0x00000000018AE000-memory.dmp	themida
behavioral1/memory/4248-224-0x0000000000F90000-0x00000000018AE000-memory.dmp	themida
behavioral1/files/0x0002000000015594-298.dat	themida
behavioral1/files/0x0002000000015594-306.dat	themida
behavioral1/memory/2544-344-0x0000000000180000-0x0000000000A9E000-memory.dmp	themida
behavioral1/memory/2544-345-0x0000000000180000-0x0000000000A9E000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MoUSO.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4248 set thread context of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
2544	MoUSO.exe
2544	MoUSO.exe
2544	MoUSO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Token: SeDebugPrivilege	2544	MoUSO.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4136	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	67
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4248 wrote to memory of 4712	4248	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	68
PID 4712 wrote to memory of 4892	4712	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	69
PID 4712 wrote to memory of 4892	4712	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	69
PID 4712 wrote to memory of 4892	4712	2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe	69

C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
"C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
  "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
  2⤵
  PID:4136
- C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
  "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4892

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\cache\MoUSO.exe

Filesize
9.1MB

MD5
58ec0acfe4edcc15917b97ef91596f07

SHA1
60e610685d9a549926e7a9b0cb6bcc6509708d3c

SHA256
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

SHA512
5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe

Filesize
9.1MB

MD5
58ec0acfe4edcc15917b97ef91596f07

SHA1
60e610685d9a549926e7a9b0cb6bcc6509708d3c

SHA256
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

SHA512
5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

Download Submit
memory/2544-345-0x0000000000180000-0x0000000000A9E000-memory.dmp

Filesize
9.1MB

Download
memory/2544-344-0x0000000000180000-0x0000000000A9E000-memory.dmp

Filesize
9.1MB

Download
memory/2544-322-0x0000000000180000-0x0000000000A9E000-memory.dmp

Filesize
9.1MB

Download
memory/4136-216-0x0000000000F90000-0x00000000018AE000-memory.dmp

Filesize
9.1MB

Download
memory/4248-159-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-155-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-124-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-125-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-126-0x0000000000F90000-0x00000000018AE000-memory.dmp

Filesize
9.1MB

Download
memory/4248-127-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-128-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-129-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-130-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-131-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-132-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-133-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-134-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-135-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-136-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-165-0x0000000005740000-0x00000000057DC000-memory.dmp

Filesize
624KB

Download
memory/4248-138-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-139-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-140-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-141-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-142-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-143-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-144-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-145-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-146-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-147-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-148-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-149-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-150-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-151-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-153-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-154-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-164-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-156-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-157-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-158-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-122-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-160-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-163-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-162-0x0000000000F90000-0x00000000018AE000-memory.dmp

Filesize
9.1MB

Download
memory/4248-161-0x0000000000F90000-0x00000000018AE000-memory.dmp

Filesize
9.1MB

Download
memory/4248-123-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-137-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-166-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-167-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-168-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-169-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-170-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-171-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-172-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-173-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-174-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-175-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-176-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-177-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-178-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-179-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-180-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-181-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-182-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-183-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-184-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-185-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-186-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-187-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-202-0x0000000003380000-0x00000000033B0000-memory.dmp

Filesize
192KB

Download
memory/4248-203-0x0000000006320000-0x00000000063B2000-memory.dmp

Filesize
584KB

Download
memory/4248-204-0x00000000068C0000-0x0000000006DBE000-memory.dmp

Filesize
5.0MB

Download
memory/4248-207-0x00000000065C0000-0x00000000065CA000-memory.dmp

Filesize
40KB

Download
memory/4248-211-0x00000000088D0000-0x00000000088E8000-memory.dmp

Filesize
96KB

Download
memory/4248-214-0x0000000008C70000-0x0000000008C8A000-memory.dmp

Filesize
104KB

Download
memory/4248-215-0x0000000008C90000-0x0000000008C96000-memory.dmp

Filesize
24KB

Download
memory/4248-224-0x0000000000F90000-0x00000000018AE000-memory.dmp

Filesize
9.1MB

Download
memory/4248-119-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-120-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-121-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4712-235-0x0000000000F90000-0x00000000018AE000-memory.dmp

Filesize
9.1MB

Download
memory/4712-255-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4712-283-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download