Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe
- Size 756KB
- Sample220520-eb7dmabbdl
- SHA256 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
- MD5 bd91a8ac0f31d7717bb654a398e92b59
- SHA1 722a0604c3709b7713114f934bde6730c4538d7a
- SHA512 a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
pony
C2
-
http://198.27.98.247/Pony/gate.php
Signatures
- suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
- suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
- suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
- suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
- Executes dropped EXE 1 IoCs
pid Process 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5104 set thread context of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeImpersonatePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeTcbPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeChangeNotifyPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeCreateTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeBackupPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeRestorePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeIncreaseQuotaPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeAssignPrimaryTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeImpersonatePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeTcbPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeChangeNotifyPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeCreateTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeBackupPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeRestorePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeIncreaseQuotaPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeAssignPrimaryTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeImpersonatePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeTcbPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeChangeNotifyPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeCreateTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeBackupPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeRestorePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeIncreaseQuotaPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeAssignPrimaryTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeImpersonatePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeTcbPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeChangeNotifyPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeCreateTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeBackupPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeRestorePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeIncreaseQuotaPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeAssignPrimaryTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeImpersonatePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeTcbPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeChangeNotifyPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeCreateTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeBackupPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeRestorePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeIncreaseQuotaPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeAssignPrimaryTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeImpersonatePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeTcbPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeChangeNotifyPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeCreateTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeBackupPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeRestorePrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeIncreaseQuotaPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe Token: SeAssignPrimaryTokenPrivilege 4560 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 PID 5104 wrote to memory of 4560 5104 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe 87 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe"C:\Users\Admin\AppData\Local\Temp\45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe"C:\Users\Admin\AppData\Local\Temp\45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:4560
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\45FE119D5B7D73A1434401129C0DDBD0012399BCDB73C.exe
- Size 756KB
- SHA256 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
- MD5 bd91a8ac0f31d7717bb654a398e92b59
- SHA1 722a0604c3709b7713114f934bde6730c4538d7a
- SHA512 a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
- SSDEEP 12288:DEsDTZuFr7yvh3Qu7FkINcH40WM5Y1A+tLCk7FO8Wms:DEsDTZuM9XfykJtLCk7Qp
- MD5 SHA1 SHA512 SSDEEP