Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 00:54
Static task
static1
Behavioral task
behavioral1
Sample
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe
Resource
win7-20220812-en
General
-
Target
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe
-
Size
156KB
-
MD5
fbd6e10afe8c8ff5f620fabcf9c3ecb9
-
SHA1
a42200d352eb648a0298e52b4e1c227a71ea762e
-
SHA256
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d
-
SHA512
c6efeadb2eb7a46ed1d38b735f8098822e0a81d716dc33471924dc7716299d1f23e8f6ea35da8104c319e823ffe560af658fa5f24cc85273076b086ec8421015
-
SSDEEP
3072:uDc95K4yZ0biYZR6c7OS6mBMzFOaLF/lPIN4Ub09Q:uIK4yqbjnEmBtaJdPO4Ub0
Malware Config
Extracted
pony
http://www.powerturk.rocks/web/gate.php
http://www.powerturk.rocks/webd/gate.php
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exedescription pid process target process PID 1884 set thread context of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exedescription pid process Token: SeImpersonatePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeTcbPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeChangeNotifyPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeCreateTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeBackupPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeRestorePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeIncreaseQuotaPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeAssignPrimaryTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeImpersonatePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeTcbPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeChangeNotifyPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeCreateTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeBackupPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeRestorePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeIncreaseQuotaPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeAssignPrimaryTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeImpersonatePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeTcbPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeChangeNotifyPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeCreateTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeBackupPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeRestorePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeIncreaseQuotaPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeAssignPrimaryTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeImpersonatePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeTcbPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeChangeNotifyPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeCreateTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeBackupPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeRestorePrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeIncreaseQuotaPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe Token: SeAssignPrimaryTokenPrivilege 1612 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exedescription pid process target process PID 1884 wrote to memory of 1696 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1696 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1696 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1696 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe PID 1884 wrote to memory of 1612 1884 d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe -
outlook_win_path 1 IoCs
Processes:
d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe"C:\Users\Admin\AppData\Local\Temp\d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe"C:\Users\Admin\AppData\Local\Temp\d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe"C:\Users\Admin\AppData\Local\Temp\d61ff62936724a5040e11ba0ee983a9dc5df130e7d20ac17d123e1b7434a364d.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1612-56-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-60-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-63-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-58-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-55-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-65-0x0000000000410F55-mapping.dmp
-
memory/1612-67-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-69-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-71-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-72-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1884-54-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/1884-70-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB