Analysis
- max time kernel
62s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/10/2021, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe
- Size 144KB
- Sample211008-ds2zssdchj
- SHA256 2cec15c8fef9435abd5c332486d8ad7083eeb9eb84de9077b5bf6bb42458dba5
- MD5 3087b67577a90aa611436c94ed23ae5a
- SHA1 6a84f2dd65787b2f9041421357c9939c63dd796d
- SHA512 f962d8c030c0185ba33e2a9ebeda782a8b794307712b408a9966a679cabc457cd79b65ce06e5608788cf7011d0f14d31dd53dd9eef5dbb846b5960f5211d72cc
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
pony
C2
-
http://n3systems.com.br/layouts/libraries/.trash/cphorde/rem.php
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adnexal8.vbe 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3128 set thread context of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeTcbPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeChangeNotifyPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeCreateTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeBackupPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeRestorePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeIncreaseQuotaPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeAssignPrimaryTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeImpersonatePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeTcbPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeChangeNotifyPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeCreateTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeBackupPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeRestorePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeIncreaseQuotaPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeAssignPrimaryTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeImpersonatePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeTcbPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeChangeNotifyPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeCreateTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeBackupPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeRestorePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeIncreaseQuotaPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeAssignPrimaryTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeImpersonatePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeTcbPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeChangeNotifyPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeCreateTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeBackupPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeRestorePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeIncreaseQuotaPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeAssignPrimaryTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeImpersonatePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeTcbPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeChangeNotifyPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeCreateTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeBackupPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeRestorePrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeIncreaseQuotaPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe Token: SeAssignPrimaryTokenPrivilege 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 3128 wrote to memory of 64 3128 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 73 PID 64 wrote to memory of 2972 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 74 PID 64 wrote to memory of 2972 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 74 PID 64 wrote to memory of 2972 64 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe 74 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe"C:\Users\Admin\AppData\Local\Temp\2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe"C:\Users\Admin\AppData\Local\Temp\2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:64 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259307687.bat" "C:\Users\Admin\AppData\Local\Temp\2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe" "3⤵PID:2972
-
-