Analysis
-
max time kernel
148s -
max time network
135s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 03:25
Static task
static1
Behavioral task
behavioral1
Sample
c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe
Resource
win10-en-20211208
General
-
Target
c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe
-
Size
9.0MB
-
MD5
7d22d5b7cac4c8789f3fe7102e459edd
-
SHA1
37ec3fab893bb88b673380c7f0356065fc607f57
-
SHA256
c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5
-
SHA512
5f9bd84f4e31b32a6339d0e4b17f7d3ddede8be11aab5e54a52199757d6f4c32b57ab8057290f33ed3c8e29abee6007d4cd74226a11090bc5475328b8888f954
Malware Config
Signatures
-
StrongPity
StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
-
StrongPity Spyware 3 IoCs
resource yara_rule behavioral1/files/0x000700000001226a-58.dat family_strongpity behavioral1/files/0x000700000001226a-59.dat family_strongpity behavioral1/files/0x000700000001226a-60.dat family_strongpity -
Executes dropped EXE 4 IoCs
pid Process 2232 idman636build7.exe 2252 sivsnui.exe 2288 srvolpsm.exe 2324 IDM1.tmp -
Loads dropped DLL 5 IoCs
pid Process 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 2252 sivsnui.exe 2232 idman636build7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\OperaSyncService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Opera\\sivsnui.exe" c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2324 IDM1.tmp -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2232 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 27 PID 1620 wrote to memory of 2232 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 27 PID 1620 wrote to memory of 2232 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 27 PID 1620 wrote to memory of 2232 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 27 PID 1620 wrote to memory of 2232 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 27 PID 1620 wrote to memory of 2232 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 27 PID 1620 wrote to memory of 2232 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 27 PID 1620 wrote to memory of 2252 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 28 PID 1620 wrote to memory of 2252 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 28 PID 1620 wrote to memory of 2252 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 28 PID 1620 wrote to memory of 2252 1620 c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe 28 PID 2252 wrote to memory of 2288 2252 sivsnui.exe 29 PID 2252 wrote to memory of 2288 2252 sivsnui.exe 29 PID 2252 wrote to memory of 2288 2252 sivsnui.exe 29 PID 2252 wrote to memory of 2288 2252 sivsnui.exe 29 PID 2232 wrote to memory of 2324 2232 idman636build7.exe 31 PID 2232 wrote to memory of 2324 2232 idman636build7.exe 31 PID 2232 wrote to memory of 2324 2232 idman636build7.exe 31 PID 2232 wrote to memory of 2324 2232 idman636build7.exe 31 PID 2232 wrote to memory of 2324 2232 idman636build7.exe 31 PID 2232 wrote to memory of 2324 2232 idman636build7.exe 31 PID 2232 wrote to memory of 2324 2232 idman636build7.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe"C:\Users\Admin\AppData\Local\Temp\c936e01333e3260547a8c319d9cfc1811ba5793e182d0688db679ec2b30644c5.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\idman636build7.exe"C:\Users\Admin\AppData\Local\Temp\idman636build7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2324
-
-
-
C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe"C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe"C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe"3⤵
- Executes dropped EXE
PID:2288
-
-