Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2022, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe
Resource
win7-20220812-en
General
-
Target
5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe
-
Size
96KB
-
MD5
39a9cf23daed372b013fa8ccf98672e0
-
SHA1
b243eacf498adb158b3421b7cc9c11a64da20364
-
SHA256
5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389
-
SHA512
aa844d7df2494bf5ba9dca55f809169b154988b776a7e9777978b560d5074f722558896ccf09330ae76f5e45376c3504b2086277fcc18077aa6b512304c8a8bd
-
SSDEEP
1536:iPGe2w9/0AMKpNGLsmYTQsLaYbbHAebk54YO/1OYr+4CDn8ATHbLqyam999Nle:i4w9cAM+YYnQCh37bkytrRo/LqyB
Malware Config
Extracted
pony
http://jsdhdje.pw:4915/way/like.php
http://kmyturr.pw:4915/way/like.php
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\tmp.tmp 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe File created C:\Windows\system32\drivers\etc\hosts.sam cmd.exe File opened for modification C:\Windows\system32\drivers\etc\hosts.sam cmd.exe -
resource yara_rule behavioral2/memory/4612-134-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/4612-135-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/4612-138-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4344 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe 81 PID 4612 wrote to memory of 4344 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe 81 PID 4612 wrote to memory of 4344 4612 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe 81 PID 4344 wrote to memory of 1124 4344 cmd.exe 83 PID 4344 wrote to memory of 1124 4344 cmd.exe 83 PID 4344 wrote to memory of 1124 4344 cmd.exe 83 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe"C:\Users\Admin\AppData\Local\Temp\5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:4612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\drivers\etc\hosts C:\Windows\system32\drivers\etc\hosts.sam /Y && at 09:43:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240577765aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\at.exeat 09:43:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240577765aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"3⤵PID:1124
-
-