Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    26-08-2023 21:25

General

  • Target

    avicap32.exe

  • Size

    6.1MB

  • MD5

    8570d48a1291cc62a902b06b7429b2dd

  • SHA1

    6f7de617e02b655c01e734e9ea30bfdfb4caaa24

  • SHA256

    729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430

  • SHA512

    43970a17e5d27801dd8306b5b228bc1ce300c07ddf9801775ea52b87d73fa96041160927ca23c5e4b98046f8aadc6973e9fda58d9bfeac25399370295c053af0

  • SSDEEP

    196608:1nXtfIhfnpg/2hk57yqx256vfOCv8q+M/VX:1nXtfIhfnpg/2hk57yqxvf1f+MZ

Score
10/10

Malware Config

Extracted

Family

allcome

C2

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

Signatures

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\avicap32.exe
    "C:\Users\Admin\AppData\Local\Temp\avicap32.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\avicap32.exe
      "C:\Users\Admin\AppData\Local\Temp\avicap32.exe"
      2⤵
        PID:2832

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2832-24-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-73-0x0000000000310000-0x000000000092A000-memory.dmp

      Filesize

      6.1MB

    • memory/2832-65-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-56-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-45-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-46-0x0000000000310000-0x000000000092A000-memory.dmp

      Filesize

      6.1MB

    • memory/2832-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2832-34-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-32-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-30-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-26-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/2832-28-0x0000000000180000-0x00000000001A3000-memory.dmp

      Filesize

      140KB

    • memory/3036-16-0x0000000000970000-0x00000000009A2000-memory.dmp

      Filesize

      200KB

    • memory/3036-5-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-0-0x0000000000310000-0x000000000092A000-memory.dmp

      Filesize

      6.1MB

    • memory/3036-17-0x0000000000A10000-0x0000000000A28000-memory.dmp

      Filesize

      96KB

    • memory/3036-18-0x0000000000310000-0x000000000092A000-memory.dmp

      Filesize

      6.1MB

    • memory/3036-19-0x0000000000D30000-0x0000000000D4A000-memory.dmp

      Filesize

      104KB

    • memory/3036-20-0x0000000002C30000-0x0000000002C70000-memory.dmp

      Filesize

      256KB

    • memory/3036-21-0x0000000000C40000-0x0000000000C46000-memory.dmp

      Filesize

      24KB

    • memory/3036-22-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-14-0x0000000074350000-0x0000000074A3E000-memory.dmp

      Filesize

      6.9MB

    • memory/3036-23-0x0000000077000000-0x0000000077047000-memory.dmp

      Filesize

      284KB

    • memory/3036-27-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-13-0x0000000000310000-0x000000000092A000-memory.dmp

      Filesize

      6.1MB

    • memory/3036-12-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-31-0x000000000E5D0000-0x000000000EBEA000-memory.dmp

      Filesize

      6.1MB

    • memory/3036-11-0x0000000077000000-0x0000000077047000-memory.dmp

      Filesize

      284KB

    • memory/3036-10-0x0000000077000000-0x0000000077047000-memory.dmp

      Filesize

      284KB

    • memory/3036-8-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-6-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-38-0x0000000074350000-0x0000000074A3E000-memory.dmp

      Filesize

      6.9MB

    • memory/3036-39-0x0000000002C30000-0x0000000002C70000-memory.dmp

      Filesize

      256KB

    • memory/3036-40-0x0000000002C30000-0x0000000002C70000-memory.dmp

      Filesize

      256KB

    • memory/3036-41-0x000000000E5D0000-0x000000000EBEA000-memory.dmp

      Filesize

      6.1MB

    • memory/3036-15-0x0000000002C30000-0x0000000002C70000-memory.dmp

      Filesize

      256KB

    • memory/3036-4-0x0000000077000000-0x0000000077047000-memory.dmp

      Filesize

      284KB

    • memory/3036-47-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-50-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-54-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-52-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-3-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-55-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-57-0x0000000077000000-0x0000000077047000-memory.dmp

      Filesize

      284KB

    • memory/3036-59-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-63-0x0000000000310000-0x000000000092A000-memory.dmp

      Filesize

      6.1MB

    • memory/3036-61-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-2-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-64-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-66-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-68-0x0000000074350000-0x0000000074A3E000-memory.dmp

      Filesize

      6.9MB

    • memory/3036-67-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-69-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-70-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-71-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-72-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-1-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB

    • memory/3036-74-0x0000000075D60000-0x0000000075E70000-memory.dmp

      Filesize

      1.1MB