Analysis
-
max time kernel
47s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:33
Static task
static1
Behavioral task
behavioral1
Sample
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe
Resource
win10v2004-20221111-en
General
-
Target
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe
-
Size
280KB
-
MD5
d78a2e8c8aeac70a63c65e07ad6ee368
-
SHA1
e434cc7204eade9dd86db22292eb4fa28a0542dd
-
SHA256
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad
-
SHA512
831866dbd686b57302bdec41305b6300f7fad52c94e7c03f0ec6c8e010bae318ee0a3f1e90a24f1253f976d0f890b1a46308239d23688be8a9f20219c66ba9bd
-
SSDEEP
6144:0kixjxFjYT8PWrg6P5yD1o4WNQqMe5R6zC:0pxjnjYhP5yD1qCqMMR6zC
Malware Config
Extracted
pony
http://77.221.144.119/p/gate.php
http://cityhotlove.com/p/gate.php
http://freefinder.me/p/gate.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
sysuovqar.exesysuovqar.exepid process 660 sysuovqar.exe 1752 sysuovqar.exe -
Processes:
resource yara_rule behavioral1/memory/1312-55-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1312-57-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1312-59-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1312-64-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1312-65-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1312-70-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1752-82-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1752-83-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1752-84-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1752-85-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exepid process 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
sysuovqar.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts sysuovqar.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
sysuovqar.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook sysuovqar.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
sysuovqar.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run sysuovqar.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\SYS_UPDATE_FC3478697FDC0282A2C4D80 = "C:\\Users\\Admin\\AppData\\Roaming\\WinRAR\\sysuovqar.exe" sysuovqar.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exesysuovqar.exedescription pid process target process PID 620 set thread context of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 660 set thread context of 1752 660 sysuovqar.exe sysuovqar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exesysuovqar.exepid process 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe 660 sysuovqar.exe 660 sysuovqar.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exesysuovqar.exedescription pid process Token: SeImpersonatePrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeTcbPrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeChangeNotifyPrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeCreateTokenPrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeBackupPrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeRestorePrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeIncreaseQuotaPrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeAssignPrimaryTokenPrivilege 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe Token: SeImpersonatePrivilege 1752 sysuovqar.exe Token: SeTcbPrivilege 1752 sysuovqar.exe Token: SeChangeNotifyPrivilege 1752 sysuovqar.exe Token: SeCreateTokenPrivilege 1752 sysuovqar.exe Token: SeBackupPrivilege 1752 sysuovqar.exe Token: SeRestorePrivilege 1752 sysuovqar.exe Token: SeIncreaseQuotaPrivilege 1752 sysuovqar.exe Token: SeAssignPrimaryTokenPrivilege 1752 sysuovqar.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.execc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exesysuovqar.exedescription pid process target process PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 620 wrote to memory of 1312 620 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe PID 1312 wrote to memory of 660 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe sysuovqar.exe PID 1312 wrote to memory of 660 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe sysuovqar.exe PID 1312 wrote to memory of 660 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe sysuovqar.exe PID 1312 wrote to memory of 660 1312 cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe PID 660 wrote to memory of 1752 660 sysuovqar.exe sysuovqar.exe -
outlook_win_path 1 IoCs
Processes:
sysuovqar.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook sysuovqar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe"C:\Users\Admin\AppData\Local\Temp\cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe"C:\Users\Admin\AppData\Local\Temp\cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exe"C:\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exe"C:\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exeFilesize
280KB
MD5d78a2e8c8aeac70a63c65e07ad6ee368
SHA1e434cc7204eade9dd86db22292eb4fa28a0542dd
SHA256cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad
SHA512831866dbd686b57302bdec41305b6300f7fad52c94e7c03f0ec6c8e010bae318ee0a3f1e90a24f1253f976d0f890b1a46308239d23688be8a9f20219c66ba9bd
-
C:\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exeFilesize
280KB
MD5d78a2e8c8aeac70a63c65e07ad6ee368
SHA1e434cc7204eade9dd86db22292eb4fa28a0542dd
SHA256cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad
SHA512831866dbd686b57302bdec41305b6300f7fad52c94e7c03f0ec6c8e010bae318ee0a3f1e90a24f1253f976d0f890b1a46308239d23688be8a9f20219c66ba9bd
-
C:\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exeFilesize
280KB
MD5d78a2e8c8aeac70a63c65e07ad6ee368
SHA1e434cc7204eade9dd86db22292eb4fa28a0542dd
SHA256cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad
SHA512831866dbd686b57302bdec41305b6300f7fad52c94e7c03f0ec6c8e010bae318ee0a3f1e90a24f1253f976d0f890b1a46308239d23688be8a9f20219c66ba9bd
-
\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exeFilesize
280KB
MD5d78a2e8c8aeac70a63c65e07ad6ee368
SHA1e434cc7204eade9dd86db22292eb4fa28a0542dd
SHA256cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad
SHA512831866dbd686b57302bdec41305b6300f7fad52c94e7c03f0ec6c8e010bae318ee0a3f1e90a24f1253f976d0f890b1a46308239d23688be8a9f20219c66ba9bd
-
\Users\Admin\AppData\Roaming\WinRAR\sysuovqar.exeFilesize
280KB
MD5d78a2e8c8aeac70a63c65e07ad6ee368
SHA1e434cc7204eade9dd86db22292eb4fa28a0542dd
SHA256cc3d7c241aadbb1abd102bd54e26dd8c487d0863e3fb752a7a44e946d20142ad
SHA512831866dbd686b57302bdec41305b6300f7fad52c94e7c03f0ec6c8e010bae318ee0a3f1e90a24f1253f976d0f890b1a46308239d23688be8a9f20219c66ba9bd
-
memory/620-61-0x00000000002A0000-0x00000000002AD000-memory.dmpFilesize
52KB
-
memory/660-68-0x0000000000000000-mapping.dmp
-
memory/1312-63-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1312-57-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1312-64-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1312-54-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1312-60-0x0000000000423AA0-mapping.dmp
-
memory/1312-59-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1312-70-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1312-65-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1312-55-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1752-78-0x0000000000423AA0-mapping.dmp
-
memory/1752-82-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1752-83-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1752-84-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1752-85-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB