Analysis
- max time kernel
71s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
29/01/2023, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe
Resource
win7-20221111-en
windows7-x64
11 signatures
150 seconds
General
- Target 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe
- Size 110KB
- Sample230129-31mmhsbf2z
- SHA256 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511
- MD5 1b7c19b813b491094d1f6ce79984c860
- SHA1 326bc0a91f072124c1e0e53b0515f97ed53f96fa
- SHA512 75ca1f6fa808c2c9f62de04ebb16421e426538f9e2e99b352cdfe04cec328b0da557747548e67bc39cf87720e20d1c4255ed974c89818659f2a83db1b96c435f
- SSDEEP 1536:TauGzN3JcY1V78adKvZCf2VY4BMCI+STZVoI87va1D57/WMN85+:TyDbHde/Y4BfV0ZVoIgazWL+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pony
C2
-
http://solejruz.info:719/way/open.php
-
http://lrekafiy.info:719/way/open.php
Signatures
-
resource yara_rule behavioral2/memory/2552-132-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2552-133-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2552-135-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2552-136-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2552-140-0x0000000000400000-0x000000000042C000-memory.dmp upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeTcbPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeChangeNotifyPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeCreateTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeBackupPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeRestorePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeIncreaseQuotaPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeAssignPrimaryTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeImpersonatePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeTcbPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeChangeNotifyPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeCreateTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeBackupPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeRestorePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeIncreaseQuotaPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeAssignPrimaryTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeImpersonatePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeTcbPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeChangeNotifyPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeCreateTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeBackupPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeRestorePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeIncreaseQuotaPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeAssignPrimaryTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeImpersonatePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeTcbPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeChangeNotifyPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeCreateTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeBackupPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeRestorePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeIncreaseQuotaPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeAssignPrimaryTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeImpersonatePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeTcbPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeChangeNotifyPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeCreateTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeBackupPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeRestorePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeIncreaseQuotaPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeAssignPrimaryTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeImpersonatePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeTcbPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeChangeNotifyPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeCreateTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeBackupPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeRestorePrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeIncreaseQuotaPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe Token: SeAssignPrimaryTokenPrivilege 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2672 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe 87 PID 2552 wrote to memory of 2672 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe 87 PID 2552 wrote to memory of 2672 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe 87 PID 2672 wrote to memory of 2328 2672 cmd.exe 89 PID 2672 wrote to memory of 2328 2672 cmd.exe 89 PID 2672 wrote to memory of 2328 2672 cmd.exe 89 PID 2552 wrote to memory of 4000 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe 90 PID 2552 wrote to memory of 4000 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe 90 PID 2552 wrote to memory of 4000 2552 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe 90 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe"C:\Users\Admin\AppData\Local\Temp\61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:2552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c at 00:01:00 /every:T,M,Th,F,W,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240593593 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts && erase %TEMP%\61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe" && copy %WINDIR%\system32\drivers\etc\hosts %WINDIR%\system32\drivers\etc\hosts.sam /Y2⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\at.exeat 00:01:00 /every:T,M,Th,F,W,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240593593 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts && erase C:\Users\Admin\AppData\Local\Temp\61db6faf4fda2cd6378c4355aead8b902f8fe6adbd962fbca98902e85d6ff511.exe"3⤵PID:2328
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:4000
-