Analysis
- max time kernel
53s - max time network
112s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/08/2021, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
BFCBCA61FAB1CEF5DBF2944B30369FFD5FDE711A3067D.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target BFCBCA61FAB1CEF5DBF2944B30369FFD5FDE711A3067D.exe
- Size 1017KB
- Sample210802-j2pas2tg1x
- SHA256 bfcbca61fab1cef5dbf2944b30369ffd5fde711a3067daf1444ce4ce987a5963
- MD5 24c7eb748e4444c4b4a9b7589b016bad
- SHA1 c9e6acb10c593eae649bb551248467444f77737f
- SHA512 f9b074525bf8d5d66ef1d64339da39e7cda3385629f3fe595d0f08125afb479e1e69aaa7984ddfd16c39f6bdb8e31d0b74b036e805d767890925fe78062f205c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
pony
C2
-
http://zandazx.webege.com/gate.php
Signatures
- suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
- suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
- Executes dropped EXE 1 IoCs
pid Process 2880 etnrxpxcm.exe -
resource yara_rule behavioral2/memory/504-120-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/504-122-0x0000000000400000-0x000000000041C000-memory.dmp upx - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2880 set thread context of 504 2880 etnrxpxcm.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2880 etnrxpxcm.exe 2880 etnrxpxcm.exe 2880 etnrxpxcm.exe 2880 etnrxpxcm.exe - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2880 etnrxpxcm.exe Token: SeImpersonatePrivilege 504 RegSvcs.exe Token: SeTcbPrivilege 504 RegSvcs.exe Token: SeChangeNotifyPrivilege 504 RegSvcs.exe Token: SeCreateTokenPrivilege 504 RegSvcs.exe Token: SeBackupPrivilege 504 RegSvcs.exe Token: SeRestorePrivilege 504 RegSvcs.exe Token: SeIncreaseQuotaPrivilege 504 RegSvcs.exe Token: SeAssignPrimaryTokenPrivilege 504 RegSvcs.exe Token: SeImpersonatePrivilege 504 RegSvcs.exe Token: SeTcbPrivilege 504 RegSvcs.exe Token: SeChangeNotifyPrivilege 504 RegSvcs.exe Token: SeCreateTokenPrivilege 504 RegSvcs.exe Token: SeBackupPrivilege 504 RegSvcs.exe Token: SeRestorePrivilege 504 RegSvcs.exe Token: SeIncreaseQuotaPrivilege 504 RegSvcs.exe Token: SeAssignPrimaryTokenPrivilege 504 RegSvcs.exe Token: SeImpersonatePrivilege 504 RegSvcs.exe Token: SeTcbPrivilege 504 RegSvcs.exe Token: SeChangeNotifyPrivilege 504 RegSvcs.exe Token: SeCreateTokenPrivilege 504 RegSvcs.exe Token: SeBackupPrivilege 504 RegSvcs.exe Token: SeRestorePrivilege 504 RegSvcs.exe Token: SeIncreaseQuotaPrivilege 504 RegSvcs.exe Token: SeAssignPrimaryTokenPrivilege 504 RegSvcs.exe Token: SeImpersonatePrivilege 504 RegSvcs.exe Token: SeTcbPrivilege 504 RegSvcs.exe Token: SeChangeNotifyPrivilege 504 RegSvcs.exe Token: SeCreateTokenPrivilege 504 RegSvcs.exe Token: SeBackupPrivilege 504 RegSvcs.exe Token: SeRestorePrivilege 504 RegSvcs.exe Token: SeIncreaseQuotaPrivilege 504 RegSvcs.exe Token: SeAssignPrimaryTokenPrivilege 504 RegSvcs.exe Token: SeImpersonatePrivilege 504 RegSvcs.exe Token: SeTcbPrivilege 504 RegSvcs.exe Token: SeChangeNotifyPrivilege 504 RegSvcs.exe Token: SeCreateTokenPrivilege 504 RegSvcs.exe Token: SeBackupPrivilege 504 RegSvcs.exe Token: SeRestorePrivilege 504 RegSvcs.exe Token: SeIncreaseQuotaPrivilege 504 RegSvcs.exe Token: SeAssignPrimaryTokenPrivilege 504 RegSvcs.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 992 wrote to memory of 2880 992 BFCBCA61FAB1CEF5DBF2944B30369FFD5FDE711A3067D.exe 75 PID 992 wrote to memory of 2880 992 BFCBCA61FAB1CEF5DBF2944B30369FFD5FDE711A3067D.exe 75 PID 992 wrote to memory of 2880 992 BFCBCA61FAB1CEF5DBF2944B30369FFD5FDE711A3067D.exe 75 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 2880 wrote to memory of 504 2880 etnrxpxcm.exe 79 PID 504 wrote to memory of 2052 504 RegSvcs.exe 80 PID 504 wrote to memory of 2052 504 RegSvcs.exe 80 PID 504 wrote to memory of 2052 504 RegSvcs.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\BFCBCA61FAB1CEF5DBF2944B30369FFD5FDE711A3067D.exe"C:\Users\Admin\AppData\Local\Temp\BFCBCA61FAB1CEF5DBF2944B30369FFD5FDE711A3067D.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\7q17329mkn8\etnrxpxcm.exe"C:\Users\Admin\7q17329mkn8\etnrxpxcm.exe" jycrsuxwgy2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259301843.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" "4⤵PID:2052
-
-
-