Analysis
- max time kernel
143s - max time network
36s - platform
windows7_x64 - resource
win7v200430 - submitted
13/07/2020, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
Oplata ponedel'nik.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target Oplata ponedel'nik.exe
- Size 1.1MB
- Sample200713-5tplt3bf4a
- SHA256 d06be7bd36b4cdd6ac12e3c7fb675515cd33ae9ea75a26e7dc7fc3a7db14caff
- MD5 9a4c7ae4bcaa653ffd966d17785ed92d
- SHA1 610343dbeb9e63ddd7fa2cfb765c8dda3c37c150
- SHA512 e6da37f1da3c075f0d435592eb69ef9cbfeb94f96f450b1a560fc7f9e7b6a5b903fdefa4fd2a749dfa0e3c5d0eac2777428e7dc92af0543cbc6ea55d3bf5d51f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Checks for installed software on the system 1 TTPs 10 IoCs
description ioc Process Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall Oplata ponedel'nik.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName Oplata ponedel'nik.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 1208 PING.EXE - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1332 Oplata ponedel'nik.exe Token: SeTcbPrivilege 1332 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 1332 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 1332 Oplata ponedel'nik.exe Token: SeBackupPrivilege 1332 Oplata ponedel'nik.exe Token: SeRestorePrivilege 1332 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 1332 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 1332 Oplata ponedel'nik.exe Token: SeImpersonatePrivilege 1332 Oplata ponedel'nik.exe Token: SeTcbPrivilege 1332 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 1332 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 1332 Oplata ponedel'nik.exe Token: SeBackupPrivilege 1332 Oplata ponedel'nik.exe Token: SeRestorePrivilege 1332 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 1332 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 1332 Oplata ponedel'nik.exe Token: SeImpersonatePrivilege 1332 Oplata ponedel'nik.exe Token: SeTcbPrivilege 1332 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 1332 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 1332 Oplata ponedel'nik.exe Token: SeBackupPrivilege 1332 Oplata ponedel'nik.exe Token: SeRestorePrivilege 1332 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 1332 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 1332 Oplata ponedel'nik.exe Token: SeImpersonatePrivilege 1332 Oplata ponedel'nik.exe Token: SeTcbPrivilege 1332 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 1332 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 1332 Oplata ponedel'nik.exe Token: SeBackupPrivilege 1332 Oplata ponedel'nik.exe Token: SeRestorePrivilege 1332 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 1332 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 1332 Oplata ponedel'nik.exe - Deletes itself 1 IoCs
pid Process 568 cmd.exe - Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
- Script User-Agent 2 IoCs
description flow ioc HTTP User-Agent header 4 WinHttp.WinHttpRequest.5.1 HTTP User-Agent header 9 WinHttp.WinHttpRequest.5.1 - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1332 1092 Oplata ponedel'nik.exe 24 PID 1092 wrote to memory of 1332 1092 Oplata ponedel'nik.exe 24 PID 1092 wrote to memory of 1332 1092 Oplata ponedel'nik.exe 24 PID 1092 wrote to memory of 1332 1092 Oplata ponedel'nik.exe 24 PID 1332 wrote to memory of 568 1332 Oplata ponedel'nik.exe 29 PID 1332 wrote to memory of 568 1332 Oplata ponedel'nik.exe 29 PID 1332 wrote to memory of 568 1332 Oplata ponedel'nik.exe 29 PID 1332 wrote to memory of 568 1332 Oplata ponedel'nik.exe 29 PID 568 wrote to memory of 1208 568 cmd.exe 31 PID 568 wrote to memory of 1208 568 cmd.exe 31 PID 568 wrote to memory of 1208 568 cmd.exe 31 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe" dfsr2⤵
- Checks for installed software on the system
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\system32\cmd.execmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\system32\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:1208
-
-
-