Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe
Resource
win10v2004-20220901-en
General
-
Target
45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe
-
Size
158KB
-
MD5
464f5bda5188d9af5bad6cbd641249f0
-
SHA1
1ec7a356f2d45f4b531b0ba1e16ff2516e441ecf
-
SHA256
45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d
-
SHA512
075ace73f2d5d052bd570a5e3ddda8fbb8d4fb2b48b2b6c8701c98857d930e360fc710282d3ee7d1ae4d29b4c2c4cfb571211b334635cf54962f8c65c9650fb0
-
SSDEEP
3072:t2TjsXe8kZ2hUlv8t/PPOrUlphVtZY8r70IouNqUzNDW69v7SO:YHsXNa2f/PdlBLYPI7Nvzd9zb
Malware Config
Extracted
pony
http://www.bing.com/gate.php
http://pages.ebay.com/gate.php
http://ngnetworld.com/gate.php
http://wordpress.com/gate.php
http://simple-cdn-node.com/gate.php
http://www.microsoft.com/gate.php
http://ngnetworld.com/1.exe?c=4
-
payload_url
http://ngnetworld.com/6.exe
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
OPERA.exeOPERA.exepid process 1536 OPERA.exe 2040 OPERA.exe -
Processes:
resource yara_rule behavioral1/memory/2040-66-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-68-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-69-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-74-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-79-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-80-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-81-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-82-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2040-84-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Loads dropped DLL 9 IoCs
Processes:
45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exeOPERA.exeOPERA.exepid process 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe 1536 OPERA.exe 1536 OPERA.exe 1536 OPERA.exe 1536 OPERA.exe 2040 OPERA.exe 2040 OPERA.exe 2040 OPERA.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
OPERA.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts OPERA.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
OPERA.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OPERA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
OPERA.exedescription pid process target process PID 1536 set thread context of 2040 1536 OPERA.exe OPERA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
OPERA.exedescription pid process Token: SeImpersonatePrivilege 2040 OPERA.exe Token: SeTcbPrivilege 2040 OPERA.exe Token: SeChangeNotifyPrivilege 2040 OPERA.exe Token: SeCreateTokenPrivilege 2040 OPERA.exe Token: SeBackupPrivilege 2040 OPERA.exe Token: SeRestorePrivilege 2040 OPERA.exe Token: SeIncreaseQuotaPrivilege 2040 OPERA.exe Token: SeAssignPrimaryTokenPrivilege 2040 OPERA.exe Token: SeImpersonatePrivilege 2040 OPERA.exe Token: SeTcbPrivilege 2040 OPERA.exe Token: SeChangeNotifyPrivilege 2040 OPERA.exe Token: SeCreateTokenPrivilege 2040 OPERA.exe Token: SeBackupPrivilege 2040 OPERA.exe Token: SeRestorePrivilege 2040 OPERA.exe Token: SeIncreaseQuotaPrivilege 2040 OPERA.exe Token: SeAssignPrimaryTokenPrivilege 2040 OPERA.exe Token: SeImpersonatePrivilege 2040 OPERA.exe Token: SeTcbPrivilege 2040 OPERA.exe Token: SeChangeNotifyPrivilege 2040 OPERA.exe Token: SeCreateTokenPrivilege 2040 OPERA.exe Token: SeBackupPrivilege 2040 OPERA.exe Token: SeRestorePrivilege 2040 OPERA.exe Token: SeIncreaseQuotaPrivilege 2040 OPERA.exe Token: SeAssignPrimaryTokenPrivilege 2040 OPERA.exe Token: SeImpersonatePrivilege 2040 OPERA.exe Token: SeTcbPrivilege 2040 OPERA.exe Token: SeChangeNotifyPrivilege 2040 OPERA.exe Token: SeCreateTokenPrivilege 2040 OPERA.exe Token: SeBackupPrivilege 2040 OPERA.exe Token: SeRestorePrivilege 2040 OPERA.exe Token: SeIncreaseQuotaPrivilege 2040 OPERA.exe Token: SeAssignPrimaryTokenPrivilege 2040 OPERA.exe Token: SeRestorePrivilege 2040 OPERA.exe Token: SeBackupPrivilege 2040 OPERA.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exeOPERA.exeOPERA.exedescription pid process target process PID 768 wrote to memory of 1536 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe OPERA.exe PID 768 wrote to memory of 1536 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe OPERA.exe PID 768 wrote to memory of 1536 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe OPERA.exe PID 768 wrote to memory of 1536 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe OPERA.exe PID 768 wrote to memory of 1536 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe OPERA.exe PID 768 wrote to memory of 1536 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe OPERA.exe PID 768 wrote to memory of 1536 768 45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 1536 wrote to memory of 2040 1536 OPERA.exe OPERA.exe PID 2040 wrote to memory of 1284 2040 OPERA.exe cmd.exe PID 2040 wrote to memory of 1284 2040 OPERA.exe cmd.exe PID 2040 wrote to memory of 1284 2040 OPERA.exe cmd.exe PID 2040 wrote to memory of 1284 2040 OPERA.exe cmd.exe PID 2040 wrote to memory of 1284 2040 OPERA.exe cmd.exe PID 2040 wrote to memory of 1284 2040 OPERA.exe cmd.exe PID 2040 wrote to memory of 1284 2040 OPERA.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
OPERA.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OPERA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe"C:\Users\Admin\AppData\Local\Temp\45990a960a138c30a7d38a9ddedc3d29f19ebf67f3686fd0e41e0cb4d0ef751d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeC:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeC:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7119885.bat" "C:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exe" "4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7119885.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
C:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
C:\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
\Users\Admin\AppData\Local\Temp\7zC1D18300\OPERA.exeFilesize
131KB
MD5839395ab05e27aad482e037b948e46b6
SHA1c2b4fb03d18a416b7d3dce150f0292416fc5d36b
SHA2563f0760d03639f1ee57fe7ce4e388f2cc6d71199f13f5fcb478a8b9de5e98c830
SHA5122268a100b6519fdd7c65099affc8ca4242a17e3682d1ed149e17124ff7f1ddb415ecc65a7bd199ab5d929156f8eb4299301b222a585e480fa7d0452ac1a1d006
-
memory/768-54-0x0000000076871000-0x0000000076873000-memory.dmpFilesize
8KB
-
memory/1284-83-0x0000000000000000-mapping.dmp
-
memory/1536-57-0x0000000000000000-mapping.dmp
-
memory/2040-66-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-65-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-74-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-68-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-79-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-80-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-81-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-82-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-70-0x000000000041A250-mapping.dmp
-
memory/2040-84-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-69-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB