Analysis
- max time kernel
143s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
11/10/2022, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
General
- Target 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe
- Size 322KB
- Sample221011-yn1amabhf9
- SHA256 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65
- MD5 276cdadf22ef7203d0b03f5133bdb0c8
- SHA1 83ff2e02c8f7e38ae4f2241dc0af3cb15af30d38
- SHA512 35dde2bdea50e5d9de9c818afab1c34ed19612c6fb87591ac3ad73bf0dd9a9082ecb65b24fd2cf964d708a5f81e664072e5a9e3695f586859c3bb8ae946752db
- SSDEEP 3072:239RyRxwOaoKNaV2gukAY4Y/wMPW3dPVjg5k/rTI/VHWL:tyWmPqi/PI1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pony
C2
-
http://acesimavicumbilaxuz.net/sazi21/gate.php
Signatures
-
resource yara_rule behavioral2/memory/1432-134-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1432-136-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1432-137-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1432-139-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1432-141-0x0000000000400000-0x000000000041C000-memory.dmp upx - Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4884 set thread context of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe Token: SeImpersonatePrivilege 1432 vbc.exe Token: SeTcbPrivilege 1432 vbc.exe Token: SeChangeNotifyPrivilege 1432 vbc.exe Token: SeCreateTokenPrivilege 1432 vbc.exe Token: SeBackupPrivilege 1432 vbc.exe Token: SeRestorePrivilege 1432 vbc.exe Token: SeIncreaseQuotaPrivilege 1432 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1432 vbc.exe Token: SeImpersonatePrivilege 1432 vbc.exe Token: SeTcbPrivilege 1432 vbc.exe Token: SeChangeNotifyPrivilege 1432 vbc.exe Token: SeCreateTokenPrivilege 1432 vbc.exe Token: SeBackupPrivilege 1432 vbc.exe Token: SeRestorePrivilege 1432 vbc.exe Token: SeIncreaseQuotaPrivilege 1432 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1432 vbc.exe Token: SeImpersonatePrivilege 1432 vbc.exe Token: SeTcbPrivilege 1432 vbc.exe Token: SeChangeNotifyPrivilege 1432 vbc.exe Token: SeCreateTokenPrivilege 1432 vbc.exe Token: SeBackupPrivilege 1432 vbc.exe Token: SeRestorePrivilege 1432 vbc.exe Token: SeIncreaseQuotaPrivilege 1432 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1432 vbc.exe Token: SeImpersonatePrivilege 1432 vbc.exe Token: SeTcbPrivilege 1432 vbc.exe Token: SeChangeNotifyPrivilege 1432 vbc.exe Token: SeCreateTokenPrivilege 1432 vbc.exe Token: SeBackupPrivilege 1432 vbc.exe Token: SeRestorePrivilege 1432 vbc.exe Token: SeIncreaseQuotaPrivilege 1432 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1432 vbc.exe Token: SeImpersonatePrivilege 1432 vbc.exe Token: SeTcbPrivilege 1432 vbc.exe Token: SeChangeNotifyPrivilege 1432 vbc.exe Token: SeCreateTokenPrivilege 1432 vbc.exe Token: SeBackupPrivilege 1432 vbc.exe Token: SeRestorePrivilege 1432 vbc.exe Token: SeIncreaseQuotaPrivilege 1432 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1432 vbc.exe Token: SeImpersonatePrivilege 1432 vbc.exe Token: SeTcbPrivilege 1432 vbc.exe Token: SeChangeNotifyPrivilege 1432 vbc.exe Token: SeCreateTokenPrivilege 1432 vbc.exe Token: SeBackupPrivilege 1432 vbc.exe Token: SeRestorePrivilege 1432 vbc.exe Token: SeIncreaseQuotaPrivilege 1432 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1432 vbc.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4884 wrote to memory of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 PID 4884 wrote to memory of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 PID 4884 wrote to memory of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 PID 4884 wrote to memory of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 PID 4884 wrote to memory of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 PID 4884 wrote to memory of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 PID 4884 wrote to memory of 1432 4884 6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe 81 PID 1432 wrote to memory of 2220 1432 vbc.exe 82 PID 1432 wrote to memory of 2220 1432 vbc.exe 82 PID 1432 wrote to memory of 2220 1432 vbc.exe 82 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe"C:\Users\Admin\AppData\Local\Temp\6f174a651234c0ccb6d0d5d35eaba8e6ad6e01781cd71c44cbb297e7f1cfce65.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240566671.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" "3⤵PID:2220
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\240566671.bat
- Size 94B
- SHA256 936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
- MD5 3880eeb1c736d853eb13b44898b718ab
- SHA1 4eec9d50360cd815211e3c4e6bdd08271b6ec8e6
- SHA512 3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
- MD5 SHA1 SHA512