Analysis
-
max time kernel
127s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 22:09
Static task
static1
Behavioral task
behavioral1
Sample
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe
Resource
win7-20220812-en
General
-
Target
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe
-
Size
94KB
-
MD5
651d055ebb603ab7f6e10e1681aa585f
-
SHA1
c18c1acf86892ca8f2642f463b7ea9070d24debf
-
SHA256
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d
-
SHA512
e3552c92648d2508e35ec51515b3faeb6bd80851b89ec82297d8b20d556747b0bdafcd6f2f543bf94925b6897f945755cf54f0258018a2461c62eb3ab557e0a0
-
SSDEEP
1536:ebF4YuEyllkUz6zPPhHSbg7QVck8MgYKlV1HVWq:eGnGU2VRsh8Mgf18
Malware Config
Extracted
pony
http://xirukitu.pw:719/way/open.php
http://ckimajuy.pw:719/way/open.php
http://rosatip.pw:719/way/upd
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2092-135-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2092-136-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2092-137-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2092-139-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2092-144-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process File created C:\Windows\SelfNotepad.exe dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe File opened for modification C:\Windows\SelfNotepad.exe dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription pid process Token: SeImpersonatePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.execmd.execmd.exedescription pid process target process PID 2092 wrote to memory of 4740 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 2092 wrote to memory of 4740 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 2092 wrote to memory of 4740 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 4740 wrote to memory of 336 4740 cmd.exe at.exe PID 4740 wrote to memory of 336 4740 cmd.exe at.exe PID 4740 wrote to memory of 336 4740 cmd.exe at.exe PID 2092 wrote to memory of 532 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 2092 wrote to memory of 532 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 2092 wrote to memory of 532 2092 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 532 wrote to memory of 1884 532 cmd.exe PING.EXE PID 532 wrote to memory of 1884 532 cmd.exe PING.EXE PID 532 wrote to memory of 1884 532 cmd.exe PING.EXE -
outlook_win_path 1 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe"C:\Users\Admin\AppData\Local\Temp\dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c at 02:06:00 /every:T,M,F,W,Th,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240623875 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts" && copy %WINDIR%\system32\drivers\etc\hosts %WINDIR%\system32\drivers\etc\hosts.sam /Y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeat 02:06:00 /every:T,M,F,W,Th,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240623875 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 10 localhost && echo deleted>"C:\Users\Admin\AppData\Local\Temp\dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-141-0x0000000000000000-mapping.dmp
-
memory/532-142-0x0000000000000000-mapping.dmp
-
memory/1884-143-0x0000000000000000-mapping.dmp
-
memory/2092-135-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2092-136-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2092-137-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2092-138-0x00000000006C0000-0x00000000006E6000-memory.dmpFilesize
152KB
-
memory/2092-139-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2092-132-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2092-134-0x00000000006C0000-0x00000000006E6000-memory.dmpFilesize
152KB
-
memory/2092-133-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2092-144-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4740-140-0x0000000000000000-mapping.dmp