Analysis
- max time kernel
91s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
07/12/2022, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
b037bcf0ca37edd57b5fdcebe0d966f0.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
General
- Target b037bcf0ca37edd57b5fdcebe0d966f0.exe
- Size 244KB
- Sample221207-16splsbd3y
- SHA256 338445e6ae33a22b32117cee1293e07975773bc632690a4d6b59f60b16dcf9bd
- MD5 b037bcf0ca37edd57b5fdcebe0d966f0
- SHA1 fac786e478f97a64bf927548c24256cc66051e32
- SHA512 19e66f94b5f8d5890d9454d9a00a3afa84b6632d0fea9ef5343f5f5d58edd5973741c014d385bb77f0384d3fcf0241e803e6d55658d095f6052226dfadcfa230
- SSDEEP 3072:AlgpcWV9YqGuLNZ7pJn0s8LZrfy3UgyHj:WPWV9r97pJ21T3D
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pony
C2
-
http://stanchib.netii.net/pony/Panel/gate.php
Attributes
-
payload_url
http://stanchib.netii.net/pony/Panel/pony.exe
Signatures
-
resource yara_rule behavioral2/memory/4872-134-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4872-137-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4872-136-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4872-139-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4872-140-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4872-142-0x0000000000400000-0x000000000041C000-memory.dmp upx - Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Cvtres.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Cvtres.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3284 set thread context of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 4872 Cvtres.exe Token: SeTcbPrivilege 4872 Cvtres.exe Token: SeChangeNotifyPrivilege 4872 Cvtres.exe Token: SeCreateTokenPrivilege 4872 Cvtres.exe Token: SeBackupPrivilege 4872 Cvtres.exe Token: SeRestorePrivilege 4872 Cvtres.exe Token: SeIncreaseQuotaPrivilege 4872 Cvtres.exe Token: SeAssignPrimaryTokenPrivilege 4872 Cvtres.exe Token: SeImpersonatePrivilege 4872 Cvtres.exe Token: SeTcbPrivilege 4872 Cvtres.exe Token: SeChangeNotifyPrivilege 4872 Cvtres.exe Token: SeCreateTokenPrivilege 4872 Cvtres.exe Token: SeBackupPrivilege 4872 Cvtres.exe Token: SeRestorePrivilege 4872 Cvtres.exe Token: SeIncreaseQuotaPrivilege 4872 Cvtres.exe Token: SeAssignPrimaryTokenPrivilege 4872 Cvtres.exe Token: SeImpersonatePrivilege 4872 Cvtres.exe Token: SeTcbPrivilege 4872 Cvtres.exe Token: SeChangeNotifyPrivilege 4872 Cvtres.exe Token: SeCreateTokenPrivilege 4872 Cvtres.exe Token: SeBackupPrivilege 4872 Cvtres.exe Token: SeRestorePrivilege 4872 Cvtres.exe Token: SeIncreaseQuotaPrivilege 4872 Cvtres.exe Token: SeAssignPrimaryTokenPrivilege 4872 Cvtres.exe Token: SeImpersonatePrivilege 4872 Cvtres.exe Token: SeTcbPrivilege 4872 Cvtres.exe Token: SeChangeNotifyPrivilege 4872 Cvtres.exe Token: SeCreateTokenPrivilege 4872 Cvtres.exe Token: SeBackupPrivilege 4872 Cvtres.exe Token: SeRestorePrivilege 4872 Cvtres.exe Token: SeIncreaseQuotaPrivilege 4872 Cvtres.exe Token: SeAssignPrimaryTokenPrivilege 4872 Cvtres.exe Token: SeImpersonatePrivilege 4872 Cvtres.exe Token: SeTcbPrivilege 4872 Cvtres.exe Token: SeChangeNotifyPrivilege 4872 Cvtres.exe Token: SeCreateTokenPrivilege 4872 Cvtres.exe Token: SeBackupPrivilege 4872 Cvtres.exe Token: SeRestorePrivilege 4872 Cvtres.exe Token: SeIncreaseQuotaPrivilege 4872 Cvtres.exe Token: SeAssignPrimaryTokenPrivilege 4872 Cvtres.exe Token: SeImpersonatePrivilege 4872 Cvtres.exe Token: SeTcbPrivilege 4872 Cvtres.exe Token: SeChangeNotifyPrivilege 4872 Cvtres.exe Token: SeCreateTokenPrivilege 4872 Cvtres.exe Token: SeBackupPrivilege 4872 Cvtres.exe Token: SeRestorePrivilege 4872 Cvtres.exe Token: SeIncreaseQuotaPrivilege 4872 Cvtres.exe Token: SeAssignPrimaryTokenPrivilege 4872 Cvtres.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3284 wrote to memory of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 PID 3284 wrote to memory of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 PID 3284 wrote to memory of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 PID 3284 wrote to memory of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 PID 3284 wrote to memory of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 PID 3284 wrote to memory of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 PID 3284 wrote to memory of 4872 3284 b037bcf0ca37edd57b5fdcebe0d966f0.exe 81 PID 4872 wrote to memory of 392 4872 Cvtres.exe 82 PID 4872 wrote to memory of 392 4872 Cvtres.exe 82 PID 4872 wrote to memory of 392 4872 Cvtres.exe 82 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b037bcf0ca37edd57b5fdcebe0d966f0.exe"C:\Users\Admin\AppData\Local\Temp\b037bcf0ca37edd57b5fdcebe0d966f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240557781.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe" "3⤵PID:392
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\240557781.bat
- Size 94B
- SHA256 936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
- MD5 3880eeb1c736d853eb13b44898b718ab
- SHA1 4eec9d50360cd815211e3c4e6bdd08271b6ec8e6
- SHA512 3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
- MD5 SHA1 SHA512