Analysis
-
max time kernel
195s -
max time network
217s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 20:19
Static task
static1
Behavioral task
behavioral1
Sample
56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe
Resource
win7-20220812-en
General
-
Target
56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe
-
Size
102KB
-
MD5
160926a2c66f63c0d53bbd61a91a9a9e
-
SHA1
cf9b7f21efb12bd7207c3986d530628020bad7dc
-
SHA256
56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e
-
SHA512
af29d20142cf45e2f550f5415bdd78f8cd2889b885b1c25026253240fab44eff87a9ea31d076c8f55e772eabbfd938c029e5d0c93fe4517179a80bd8f9f29c98
-
SSDEEP
3072:4h13GPBlKElx7peWSbiUQ+BWRClb89UzEqFOX:4h1Wz77pVSmf+4oB8ezqX
Malware Config
Extracted
pony
http://115.47.49.181/xSZ64Wiax/ojXVZBxRQVfp6gAUziCGnB8V7Aikbs0Z.php
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeTcbPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeChangeNotifyPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeCreateTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeBackupPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeRestorePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeIncreaseQuotaPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeAssignPrimaryTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeImpersonatePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeTcbPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeChangeNotifyPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeCreateTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeBackupPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeRestorePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeIncreaseQuotaPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeAssignPrimaryTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeImpersonatePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeTcbPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeChangeNotifyPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeCreateTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeBackupPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeRestorePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeIncreaseQuotaPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeAssignPrimaryTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeImpersonatePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeTcbPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeChangeNotifyPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeCreateTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeBackupPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeRestorePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeIncreaseQuotaPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeAssignPrimaryTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeImpersonatePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeTcbPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeChangeNotifyPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeCreateTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeBackupPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeRestorePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeIncreaseQuotaPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeAssignPrimaryTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeImpersonatePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeTcbPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeChangeNotifyPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeCreateTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeBackupPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeRestorePrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeIncreaseQuotaPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe Token: SeAssignPrimaryTokenPrivilege 1128 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe"C:\Users\Admin\AppData\Local\Temp\56a2ab169e4914d0501fc30fdeea4c1d6b6b37b759796d2f9cc9e778f4916d0e.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:1128