Analysis
-
max time kernel
184s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:16
Static task
static1
Behavioral task
behavioral1
Sample
1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe
Resource
win7-20221111-en
General
-
Target
1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe
-
Size
123KB
-
MD5
cfc7b9dff5ce62a12e31457d974e5618
-
SHA1
7cc2c289249a20b3721f3cfa6fda392fb5ea4acc
-
SHA256
1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543
-
SHA512
78086c5542d905b837d17028a1af2acee78c68021b93fb1cac3d0f5bfd1a812d01a37485e3fa85ad2de5d0ee6921388c519b18408f0cdac6ef3b54852a01bde9
-
SSDEEP
1536:rzqcjXrsXKrOUgDcqIunaRRyS8G+mt1ZFZ2EVA6UwUXSC9fDoQSjWv28fkrcNg17:rRGRjPPob+k1G6UNicYWl6
Malware Config
Extracted
pony
http://biogenx.net:8080/forum/viewtopic.php
http://datingandfriendfinder.net:8080/forum/viewtopic.php
http://116.122.158.195:8080/forum/viewtopic.php
http://siteseoguide.com:8080/forum/viewtopic.php
-
payload_url
http://www.serumx.com.tr/g3Asmrw.exe
http://kgori.co.za/6dne5e.exe
http://aecon.gr/mw3rhpQ2.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exedescription pid process Token: SeImpersonatePrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe Token: SeTcbPrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe Token: SeChangeNotifyPrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe Token: SeCreateTokenPrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe Token: SeBackupPrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe Token: SeRestorePrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe Token: SeIncreaseQuotaPrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe Token: SeAssignPrimaryTokenPrivilege 1364 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe -
outlook_win_path 1 IoCs
Processes:
1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe"C:\Users\Admin\AppData\Local\Temp\1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path