Analysis
-
max time kernel
151s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 14:31
Static task
static1
Behavioral task
behavioral1
Sample
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe
Resource
win7-20220812-en
General
-
Target
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe
-
Size
277KB
-
MD5
9c3eb9d6d97bac4824476f30daf14ea0
-
SHA1
e16aac321c4c9ac7c5bdab14871639306f818a27
-
SHA256
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c
-
SHA512
d507d363d34bcb77ef945e715d712b36e0cf5d1c71fddc801dad01e12f722725fec2a006370423d7f51279a2ca64d4a17257969004adce6cc6476f439ca8ffb6
-
SSDEEP
6144:uG10m1mYfBH81GQd7duWNELJzjjb7yj4qGt7eGgH2X:31LNMbdRBNIyj4HtS0X
Malware Config
Extracted
pony
http://azpo05.no-ip.biz/pon/gate.php
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exedescription pid process target process PID 1632 set thread context of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exefca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exedescription pid process Token: SeDebugPrivilege 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeImpersonatePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeTcbPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeChangeNotifyPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeCreateTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeBackupPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeRestorePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeIncreaseQuotaPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeAssignPrimaryTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeImpersonatePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeTcbPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeChangeNotifyPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeCreateTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeBackupPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeRestorePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeIncreaseQuotaPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeAssignPrimaryTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeImpersonatePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeTcbPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeChangeNotifyPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeCreateTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeBackupPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeRestorePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeIncreaseQuotaPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeAssignPrimaryTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeImpersonatePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeTcbPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeChangeNotifyPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeCreateTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeBackupPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeRestorePrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeIncreaseQuotaPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe Token: SeAssignPrimaryTokenPrivilege 240 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exedescription pid process target process PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe PID 1632 wrote to memory of 240 1632 fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe -
outlook_win_path 1 IoCs
Processes:
fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe"C:\Users\Admin\AppData\Local\Temp\fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe"C:\Users\Admin\AppData\Local\Temp\fca39b0e6b64697c9a44303bba1dc35d51b6dfcd56a28e77912cc7484513822c.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-61-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/240-57-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/240-58-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/240-60-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/240-63-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/240-64-0x00000000004100CA-mapping.dmp
-
memory/240-66-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/240-69-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/240-70-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1632-55-0x00000000748F0000-0x0000000074E9B000-memory.dmpFilesize
5.7MB
-
memory/1632-56-0x00000000748F0000-0x0000000074E9B000-memory.dmpFilesize
5.7MB
-
memory/1632-54-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1632-67-0x00000000748F0000-0x0000000074E9B000-memory.dmpFilesize
5.7MB