Analysis
- max time kernel
91s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2022, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
- Target BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe
- Size 145KB
- Sample221110-lv3ccaggd2
- SHA256 bbfa53306efe38a0f93d4e3a21acd8c7171a8d7187767479746566b967605c05
- MD5 ded1a98de51884ce32a29bd8c5d20065
- SHA1 c20eb6d8374ca201c8fab06601e318914e404a0b
- SHA512 d96e5237d4fdef9913e0dd150ee82c2436c8735efe42e83d3fe29212c0ed5f017bc232bdd35087d5c2548a9be6161a1236cd99d408ebb31504795e9f33374a8c
- SSDEEP 3072:8nLc57faEHNvVcH3ZJe57Z2PQjKRs+BwwXM0m1Gj55r5xpcD:KuGehVGE/j6d21u55rvp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pony
C2
-
http://androidtablets.co.uk/php/gate.php
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3544 set thread context of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeImpersonatePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeTcbPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeChangeNotifyPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeCreateTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeBackupPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeRestorePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeIncreaseQuotaPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeAssignPrimaryTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeImpersonatePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeTcbPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeChangeNotifyPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeCreateTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeBackupPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeRestorePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeIncreaseQuotaPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeAssignPrimaryTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeImpersonatePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeTcbPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeChangeNotifyPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeCreateTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeBackupPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeRestorePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeIncreaseQuotaPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeAssignPrimaryTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeImpersonatePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeTcbPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeChangeNotifyPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeCreateTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeBackupPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeRestorePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeIncreaseQuotaPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeAssignPrimaryTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeImpersonatePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeTcbPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeChangeNotifyPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeCreateTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeBackupPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeRestorePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeIncreaseQuotaPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeAssignPrimaryTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeImpersonatePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeTcbPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeChangeNotifyPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeCreateTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeBackupPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeRestorePrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeIncreaseQuotaPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe Token: SeAssignPrimaryTokenPrivilege 2020 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 PID 3544 wrote to memory of 2020 3544 BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe 87 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe"C:\Users\Admin\AppData\Local\Temp\BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe"C:\Users\Admin\AppData\Local\Temp\BBFA53306EFE38A0F93D4E3A21ACD8C7171A8D7187767.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:2020
-