Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    28-08-2023 01:32

General

  • Target

    729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.exe

  • Size

    6MB

  • MD5

    8570d48a1291cc62a902b06b7429b2dd

  • SHA1

    6f7de617e02b655c01e734e9ea30bfdfb4caaa24

  • SHA256

    729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430

  • SHA512

    43970a17e5d27801dd8306b5b228bc1ce300c07ddf9801775ea52b87d73fa96041160927ca23c5e4b98046f8aadc6973e9fda58d9bfeac25399370295c053af0

  • SSDEEP

    196608:1nXtfIhfnpg/2hk57yqx256vfOCv8q+M/VX:1nXtfIhfnpg/2hk57yqxvf1f+MZ

Score
10/10

Malware Config

Extracted

Family

allcome

C2

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

Signatures

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.exe
    "C:\Users\Admin\AppData\Local\Temp\729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.exe
      "C:\Users\Admin\AppData\Local\Temp\729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.exe"
      2⤵
        PID:2732

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2732-36-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-81-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-82-0x0000000000AB0000-0x00000000010CA000-memory.dmp
      Filesize

      6MB

    • memory/2732-80-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-59-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-58-0x0000000000AB0000-0x00000000010CA000-memory.dmp
      Filesize

      6MB

    • memory/2732-56-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/2732-45-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-43-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-42-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-41-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2732-39-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/2780-20-0x0000000000AB0000-0x00000000010CA000-memory.dmp
      Filesize

      6MB

    • memory/2780-50-0x00000000053A0000-0x00000000053E0000-memory.dmp
      Filesize

      256KB

    • memory/2780-17-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-16-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-0-0x0000000000AB0000-0x00000000010CA000-memory.dmp
      Filesize

      6MB

    • memory/2780-19-0x00000000747A0000-0x0000000074E8E000-memory.dmp
      Filesize

      6MB

    • memory/2780-21-0x00000000053A0000-0x00000000053E0000-memory.dmp
      Filesize

      256KB

    • memory/2780-22-0x0000000000A10000-0x0000000000A42000-memory.dmp
      Filesize

      200KB

    • memory/2780-23-0x0000000000A80000-0x0000000000A98000-memory.dmp
      Filesize

      96KB

    • memory/2780-24-0x0000000000AB0000-0x00000000010CA000-memory.dmp
      Filesize

      6MB

    • memory/2780-25-0x00000000028D0000-0x00000000028EA000-memory.dmp
      Filesize

      104KB

    • memory/2780-26-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-27-0x0000000077300000-0x0000000077347000-memory.dmp
      Filesize

      284KB

    • memory/2780-30-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-29-0x0000000004BB0000-0x0000000004BB6000-memory.dmp
      Filesize

      24KB

    • memory/2780-28-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-32-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-31-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-33-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-34-0x00000000053A0000-0x00000000053E0000-memory.dmp
      Filesize

      256KB

    • memory/2780-13-0x0000000077300000-0x0000000077347000-memory.dmp
      Filesize

      284KB

    • memory/2780-35-0x000000000E710000-0x000000000ED2A000-memory.dmp
      Filesize

      6MB

    • memory/2780-14-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-15-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-12-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-9-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-10-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-11-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-49-0x00000000747A0000-0x0000000074E8E000-memory.dmp
      Filesize

      6MB

    • memory/2780-18-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-51-0x00000000053A0000-0x00000000053E0000-memory.dmp
      Filesize

      256KB

    • memory/2780-53-0x000000000E710000-0x000000000ED2A000-memory.dmp
      Filesize

      6MB

    • memory/2780-8-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-7-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-60-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-62-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-63-0x0000000000AB0000-0x00000000010CA000-memory.dmp
      Filesize

      6MB

    • memory/2780-4-0x0000000077300000-0x0000000077347000-memory.dmp
      Filesize

      284KB

    • memory/2780-65-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-64-0x0000000077300000-0x0000000077347000-memory.dmp
      Filesize

      284KB

    • memory/2780-67-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-66-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-71-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-70-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-69-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-68-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-72-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-79-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-6-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-78-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-77-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-76-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-75-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-74-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-73-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-2-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-1-0x0000000075850000-0x0000000075960000-memory.dmp
      Filesize

      1MB

    • memory/2780-83-0x00000000747A0000-0x0000000074E8E000-memory.dmp
      Filesize

      6MB