Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
22/11/2023, 10:16
General
-
Target
SecuriteInfo.com.W32.ClipBanker.BM.gen.Eldorado.29544.5170.exe
-
Size
5.7MB
-
MD5
c0ef9d267c5557088c0724b75f1d10b5
-
SHA1
160a3a4bd2522bf2da9959d46bef2066d69b4e35
-
SHA256
2b4eb665e3459f0bad9d1564c0e9bcf603057c73996290344c92b6c42d6bc66d
-
SHA512
ec13ee5881737f0fef46b2657c5d5d40ebe7d52867063801cb9fdabc19ce062c22da799b1a1c7616024f835aee0b340d338abe8e08d64cda4f427ad162cf2031
-
SSDEEP
98304:Pl1miR1gYgNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJvHfc10YS29F+bfbJBQJqP:ZgYgNvpbXZ778hsIvY6j15fc1S26TbvP
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Themida packer 35 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.ClipBanker.BM.gen.Eldorado.29544.5170.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.ClipBanker.BM.gen.Eldorado.29544.5170.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s3o4.0.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\pinterests\XRJNZC.exe"C:\ProgramData\pinterests\XRJNZC.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr C:\ProgramData\pinterests\XRJNZC.exe /f4⤵
- Creates scheduled task(s)
-
-
-
-
C:\ProgramData\pinterests\XRJNZC.exeC:\ProgramData\pinterests\XRJNZC.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\pinterests\XRJNZC.exeC:\ProgramData\pinterests\XRJNZC.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD5c0ef9d267c5557088c0724b75f1d10b5
SHA1160a3a4bd2522bf2da9959d46bef2066d69b4e35
SHA2562b4eb665e3459f0bad9d1564c0e9bcf603057c73996290344c92b6c42d6bc66d
SHA512ec13ee5881737f0fef46b2657c5d5d40ebe7d52867063801cb9fdabc19ce062c22da799b1a1c7616024f835aee0b340d338abe8e08d64cda4f427ad162cf2031
-
Filesize
5.7MB
MD5c0ef9d267c5557088c0724b75f1d10b5
SHA1160a3a4bd2522bf2da9959d46bef2066d69b4e35
SHA2562b4eb665e3459f0bad9d1564c0e9bcf603057c73996290344c92b6c42d6bc66d
SHA512ec13ee5881737f0fef46b2657c5d5d40ebe7d52867063801cb9fdabc19ce062c22da799b1a1c7616024f835aee0b340d338abe8e08d64cda4f427ad162cf2031
-
Filesize
5.7MB
MD5c0ef9d267c5557088c0724b75f1d10b5
SHA1160a3a4bd2522bf2da9959d46bef2066d69b4e35
SHA2562b4eb665e3459f0bad9d1564c0e9bcf603057c73996290344c92b6c42d6bc66d
SHA512ec13ee5881737f0fef46b2657c5d5d40ebe7d52867063801cb9fdabc19ce062c22da799b1a1c7616024f835aee0b340d338abe8e08d64cda4f427ad162cf2031
-
Filesize
5.7MB
MD5c0ef9d267c5557088c0724b75f1d10b5
SHA1160a3a4bd2522bf2da9959d46bef2066d69b4e35
SHA2562b4eb665e3459f0bad9d1564c0e9bcf603057c73996290344c92b6c42d6bc66d
SHA512ec13ee5881737f0fef46b2657c5d5d40ebe7d52867063801cb9fdabc19ce062c22da799b1a1c7616024f835aee0b340d338abe8e08d64cda4f427ad162cf2031
-
Filesize
176B
MD56f3b1c931861427ccf8d31b5fa64da9f
SHA17c76006c9c96d37f6de35e178beb0d0dc14aaa90
SHA25655bcbd0610a067c72ba9ca3e947ea10ccfc0ceefad6db133f730131874f05612
SHA512f570e58e127940cc4c9dd455fbd1aa484aeda6252f360b003d244079b8c97f67892bccbb91ffe6f5d537442cd48745bd18c4f294ea59e36027140f3f67e4f2c3
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
8KB
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.3MB