Analysis
- max time kernel
16s - max time network
136s - platform
windows10_x64 - resource
win10-en - submitted
09/09/2021, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe
- Size 188KB
- Sample210909-p3jrragbf3
- SHA256 ceb0152cfbe3f282e114c269fd46ba389057c8d9b984c70e10df08752b229669
- MD5 a5ab0b439dbe5a12f40eda7c020b1ee3
- SHA1 60cf3cecd39d82c131c75eaeb2ed3353853419b5
- SHA512 9cc8fef963cca8073b82e11ef9e22fdf0edbbdf9937441f519f673e815015b23a8fc06f3f80c2a2b50659c0d7b33b923e73880d35f6026c006873fdec33e6b85
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
pony
C2
-
http://msn.com/gate.php
-
http://nwam1.fav.al/st/gate.php
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3264 set thread context of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeTcbPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeChangeNotifyPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeCreateTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeBackupPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeRestorePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeIncreaseQuotaPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeAssignPrimaryTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeImpersonatePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeTcbPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeChangeNotifyPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeCreateTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeBackupPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeRestorePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeIncreaseQuotaPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeAssignPrimaryTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeImpersonatePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeTcbPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeChangeNotifyPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeCreateTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeBackupPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeRestorePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeIncreaseQuotaPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeAssignPrimaryTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeImpersonatePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeTcbPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeChangeNotifyPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeCreateTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeBackupPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeRestorePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeIncreaseQuotaPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeAssignPrimaryTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeImpersonatePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeTcbPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeChangeNotifyPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeCreateTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeBackupPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeRestorePrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeIncreaseQuotaPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe Token: SeAssignPrimaryTokenPrivilege 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3264 wrote to memory of 3120 3264 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 79 PID 3120 wrote to memory of 3964 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 80 PID 3120 wrote to memory of 3964 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 80 PID 3120 wrote to memory of 3964 3120 CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe"C:\Users\Admin\AppData\Local\Temp\CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe"C:\Users\Admin\AppData\Local\Temp\CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259279046.bat" "C:\Users\Admin\AppData\Local\Temp\CEB0152CFBE3F282E114C269FD46BA389057C8D9B984C.exe" "3⤵PID:3964
-
-