Analysis
- max time kernel
120s - max time network
123s - platform
windows10_x64 - resource
win10 - submitted
13/07/2020, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
Oplata ponedel'nik.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target Oplata ponedel'nik.exe
- Size 1.1MB
- Sample200713-5tplt3bf4a
- SHA256 d06be7bd36b4cdd6ac12e3c7fb675515cd33ae9ea75a26e7dc7fc3a7db14caff
- MD5 9a4c7ae4bcaa653ffd966d17785ed92d
- SHA1 610343dbeb9e63ddd7fa2cfb765c8dda3c37c150
- SHA512 e6da37f1da3c075f0d435592eb69ef9cbfeb94f96f450b1a560fc7f9e7b6a5b903fdefa4fd2a749dfa0e3c5d0eac2777428e7dc92af0543cbc6ea55d3bf5d51f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 1892 PING.EXE - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Script User-Agent 2 IoCs
description flow ioc HTTP User-Agent header 3 WinHttp.WinHttpRequest.5.1 HTTP User-Agent header 4 WinHttp.WinHttpRequest.5.1 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks for installed software on the system 1 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName Oplata ponedel'nik.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName Oplata ponedel'nik.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall Oplata ponedel'nik.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall Oplata ponedel'nik.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3948 2460 Oplata ponedel'nik.exe 67 PID 2460 wrote to memory of 3948 2460 Oplata ponedel'nik.exe 67 PID 2460 wrote to memory of 3948 2460 Oplata ponedel'nik.exe 67 PID 3948 wrote to memory of 3568 3948 Oplata ponedel'nik.exe 68 PID 3948 wrote to memory of 3568 3948 Oplata ponedel'nik.exe 68 PID 3568 wrote to memory of 1892 3568 cmd.exe 70 PID 3568 wrote to memory of 1892 3568 cmd.exe 70 - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 3948 Oplata ponedel'nik.exe Token: SeTcbPrivilege 3948 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 3948 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeBackupPrivilege 3948 Oplata ponedel'nik.exe Token: SeRestorePrivilege 3948 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 3948 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeImpersonatePrivilege 3948 Oplata ponedel'nik.exe Token: SeTcbPrivilege 3948 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 3948 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeBackupPrivilege 3948 Oplata ponedel'nik.exe Token: SeRestorePrivilege 3948 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 3948 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeImpersonatePrivilege 3948 Oplata ponedel'nik.exe Token: SeTcbPrivilege 3948 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 3948 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeBackupPrivilege 3948 Oplata ponedel'nik.exe Token: SeRestorePrivilege 3948 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 3948 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeImpersonatePrivilege 3948 Oplata ponedel'nik.exe Token: SeTcbPrivilege 3948 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 3948 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeBackupPrivilege 3948 Oplata ponedel'nik.exe Token: SeRestorePrivilege 3948 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 3948 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeImpersonatePrivilege 3948 Oplata ponedel'nik.exe Token: SeTcbPrivilege 3948 Oplata ponedel'nik.exe Token: SeChangeNotifyPrivilege 3948 Oplata ponedel'nik.exe Token: SeCreateTokenPrivilege 3948 Oplata ponedel'nik.exe Token: SeBackupPrivilege 3948 Oplata ponedel'nik.exe Token: SeRestorePrivilege 3948 Oplata ponedel'nik.exe Token: SeIncreaseQuotaPrivilege 3948 Oplata ponedel'nik.exe Token: SeAssignPrimaryTokenPrivilege 3948 Oplata ponedel'nik.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe" dfsr2⤵
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3948 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\system32\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:1892
-
-
-