Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:13
Static task
static1
Behavioral task
behavioral1
Sample
KlKLxQh6EFCmq7y.exe
Resource
win7-20240508-en
General
-
Target
KlKLxQh6EFCmq7y.exe
-
Size
406KB
-
MD5
c00665197e09b1dcfb40cf738a40718c
-
SHA1
a8bd839fa38eabb41c413956e9377d61bf2ec5f0
-
SHA256
f90a8129d355dcadb031595d27f4355f296e6911e782ba5492c0d800ac602d45
-
SHA512
b0bf8926d7add78f1a41a4ff091c0578cce7451eebd0ef5ef2a2597eb49f0c09da233ce735ddc7e2f5a3975f816070b0a8a853e9e351692a1ccd3667b7890e0e
-
SSDEEP
6144:Z0HfTUJxL4XUhahXxC1V2fj8MawfrTX6BUch7KNRN5KAFsfWd:Z0/AxLfUhCb2L8Mjfr7cUcYx5K
Malware Config
Extracted
pony
http://mci-consultant.id/oo/panelnew/gate.php
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 380 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
KlKLxQh6EFCmq7y.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts KlKLxQh6EFCmq7y.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
KlKLxQh6EFCmq7y.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook KlKLxQh6EFCmq7y.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
KlKLxQh6EFCmq7y.exedescription pid process target process PID 1616 set thread context of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
KlKLxQh6EFCmq7y.exeKlKLxQh6EFCmq7y.exedescription pid process Token: SeDebugPrivilege 1616 KlKLxQh6EFCmq7y.exe Token: SeImpersonatePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeTcbPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeChangeNotifyPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeCreateTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeBackupPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeRestorePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeIncreaseQuotaPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeAssignPrimaryTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeImpersonatePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeTcbPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeChangeNotifyPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeCreateTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeBackupPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeRestorePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeIncreaseQuotaPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeAssignPrimaryTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeImpersonatePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeTcbPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeChangeNotifyPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeCreateTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeBackupPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeRestorePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeIncreaseQuotaPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeAssignPrimaryTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeImpersonatePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeTcbPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeChangeNotifyPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeCreateTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeBackupPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeRestorePrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeIncreaseQuotaPrivilege 2480 KlKLxQh6EFCmq7y.exe Token: SeAssignPrimaryTokenPrivilege 2480 KlKLxQh6EFCmq7y.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
KlKLxQh6EFCmq7y.exeKlKLxQh6EFCmq7y.exedescription pid process target process PID 1616 wrote to memory of 2500 1616 KlKLxQh6EFCmq7y.exe schtasks.exe PID 1616 wrote to memory of 2500 1616 KlKLxQh6EFCmq7y.exe schtasks.exe PID 1616 wrote to memory of 2500 1616 KlKLxQh6EFCmq7y.exe schtasks.exe PID 1616 wrote to memory of 2500 1616 KlKLxQh6EFCmq7y.exe schtasks.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 1616 wrote to memory of 2480 1616 KlKLxQh6EFCmq7y.exe KlKLxQh6EFCmq7y.exe PID 2480 wrote to memory of 380 2480 KlKLxQh6EFCmq7y.exe cmd.exe PID 2480 wrote to memory of 380 2480 KlKLxQh6EFCmq7y.exe cmd.exe PID 2480 wrote to memory of 380 2480 KlKLxQh6EFCmq7y.exe cmd.exe PID 2480 wrote to memory of 380 2480 KlKLxQh6EFCmq7y.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
KlKLxQh6EFCmq7y.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook KlKLxQh6EFCmq7y.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KlKLxQh6EFCmq7y.exe"C:\Users\Admin\AppData\Local\Temp\KlKLxQh6EFCmq7y.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\udNWzzPmUTy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCADD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\KlKLxQh6EFCmq7y.exe"C:\Users\Admin\AppData\Local\Temp\KlKLxQh6EFCmq7y.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\259449428.bat" "C:\Users\Admin\AppData\Local\Temp\KlKLxQh6EFCmq7y.exe" "3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\259449428.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\tmpCADD.tmpFilesize
1KB
MD56a5eed6cfaf4c19a96c3675e56f92513
SHA16c67176689fd575d0ea958b2a0a855e3d7dd34cd
SHA2564b952ab1995f3fd821ac2c2eaaa2e2573e60b1262bd64f528e327062f8be4582
SHA51257855637f2d950917c613bfcaec2647709b78b2e67b4c013b95040668f4811b6a4b014154fe4da5acdd1924dc949ac53d3c56f5cc4b40723c2807972cfbc65c0
-
memory/1616-4-0x00000000742DE000-0x00000000742DF000-memory.dmpFilesize
4KB
-
memory/1616-2-0x0000000000530000-0x0000000000542000-memory.dmpFilesize
72KB
-
memory/1616-1-0x0000000000040000-0x00000000000AA000-memory.dmpFilesize
424KB
-
memory/1616-5-0x00000000742D0000-0x00000000749BE000-memory.dmpFilesize
6.9MB
-
memory/1616-6-0x0000000004150000-0x0000000004186000-memory.dmpFilesize
216KB
-
memory/1616-7-0x0000000004550000-0x000000000456E000-memory.dmpFilesize
120KB
-
memory/1616-3-0x00000000742D0000-0x00000000749BE000-memory.dmpFilesize
6.9MB
-
memory/1616-0-0x00000000742DE000-0x00000000742DF000-memory.dmpFilesize
4KB
-
memory/1616-26-0x00000000742D0000-0x00000000749BE000-memory.dmpFilesize
6.9MB
-
memory/2480-23-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2480-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2480-19-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2480-15-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2480-25-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2480-17-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2480-13-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2480-35-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB