pony | b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf

General

Target

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
Size

790KB
MD5

c767466a3e546cf4c3f4c7d06674f649
SHA1

86fd75f689e1cdae1ebe04e75cb8c41007d58f8a
SHA256

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf
SHA512

455df92cf93a0d78022275230f095c8ff502bfb046b407262c0043159d198294c95c32821b284f72e868983d62077e9a8a99ded02f5c4d18ef40ee2e97c9ea06

Score

10^/10

pony collection discovery evasion persistence rat spyware stealer suricata

Malware Config

Extracted

Family

pony

C2

http://serniorduncan30.host56.com/html/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata
suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
suricata
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegAsm.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegAsm.exe

Adds Run key to start application 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

description	pid	process	target process
PID 1448 set thread context of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

pid	process
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
Token: SeImpersonatePrivilege	1900	RegAsm.exe
Token: SeTcbPrivilege	1900	RegAsm.exe
Token: SeChangeNotifyPrivilege	1900	RegAsm.exe
Token: SeCreateTokenPrivilege	1900	RegAsm.exe
Token: SeBackupPrivilege	1900	RegAsm.exe
Token: SeRestorePrivilege	1900	RegAsm.exe
Token: SeIncreaseQuotaPrivilege	1900	RegAsm.exe
Token: SeAssignPrimaryTokenPrivilege	1900	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

description	pid	process	target process
PID 1448 wrote to memory of 848	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 1448 wrote to memory of 848	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 1448 wrote to memory of 848	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 1448 wrote to memory of 848	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 1448 wrote to memory of 1788	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1788	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1788	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1788	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 1900	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 1448 wrote to memory of 268	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 268	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 268	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 268	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 700	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 700	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 700	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 700	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1844	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1844	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1844	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1844	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1196	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1196	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1196	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1196	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 948	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 948	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 948	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 948	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1928	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1928	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1928	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1928	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1224	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1224	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1224	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1224	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 564	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 564	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 564	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 564	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1596	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1596	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1596	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1596	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 680	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 680	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 680	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 680	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1576	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1576	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1576	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 1448 wrote to memory of 1576	1448	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

848 attrib.exe

pid	process
848	attrib.exe

outlook_win_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
"C:\Users\Admin\AppData\Local\Temp\b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
2⤵
- Views/modifies file attributes
PID:848

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:1900

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:268

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:700

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1844

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1196

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:948

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1928

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1224

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:564

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1596

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:680

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1576

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:752

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1988

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:584

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:940

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:936

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1520

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:276

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-68-0x0000000000000000-mapping.dmp

Download
memory/276-89-0x0000000000000000-mapping.dmp

Download
memory/564-79-0x0000000000000000-mapping.dmp

Download
memory/584-85-0x0000000000000000-mapping.dmp

Download
memory/680-81-0x0000000000000000-mapping.dmp

Download
memory/700-70-0x0000000000000000-mapping.dmp

Download
memory/752-83-0x0000000000000000-mapping.dmp

Download
memory/848-56-0x0000000000000000-mapping.dmp

Download
memory/936-87-0x0000000000000000-mapping.dmp

Download
memory/940-86-0x0000000000000000-mapping.dmp

Download
memory/948-76-0x0000000000000000-mapping.dmp

Download
memory/1196-75-0x0000000000000000-mapping.dmp

Download
memory/1224-78-0x0000000000000000-mapping.dmp

Download
memory/1448-55-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1472-90-0x0000000000000000-mapping.dmp

Download
memory/1520-88-0x0000000000000000-mapping.dmp

Download
memory/1576-82-0x0000000000000000-mapping.dmp

Download
memory/1596-80-0x0000000000000000-mapping.dmp

Download
memory/1788-57-0x0000000000000000-mapping.dmp

Download
memory/1844-73-0x0000000000000000-mapping.dmp

Download
memory/1900-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-67-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-65-0x000000000040FF04-mapping.dmp

Download
memory/1900-61-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-59-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-58-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-64-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-74-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-72-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1928-77-0x0000000000000000-mapping.dmp

Download
memory/1988-84-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads