Overview
overview
10Static
static
724.exe
windows7-x64
1024.exe
windows10-2004-x64
104.exe
windows7-x64
104.exe
windows10-2004-x64
107.exe
windows7-x64
107.exe
windows10-2004-x64
10Order.exe
windows7-x64
10Order.exe
windows10-2004-x64
10load2.exe
windows7-x64
load2.exe
windows10-2004-x64
spart.exe
windows7-x64
7spart.exe
windows10-2004-x64
7swift.exe
windows7-x64
10swift.exe
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 17:00
Behavioral task
behavioral1
Sample
24.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
24.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
4.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
7.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Order.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Order.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
load2.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
load2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
spart.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
spart.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
swift.exe
Resource
win7-20240221-en
General
-
Target
Order.exe
-
Size
222KB
-
MD5
28ddb3f1013592bb1b4413ee39009a57
-
SHA1
17f9ae6d47506306352f9670c8dfed99322a3337
-
SHA256
c552c6df4bc0a5aff777c0d4c3b3aec0f2c042d68c17ecd316bfd58b04477698
-
SHA512
e96ab074f89cdd9e5ed94f279884eb4fbf44a1f9ca6da0e1507e0029df45c2f3c5b5ea9be62dc758f783d3ed26f0a98e15a67b5e2592cc872731739b0da05424
-
SSDEEP
6144:kdufqYEGgI+/bHmLpmTvnwM2mksSFwKQ:hqYEGgI+ymvwM29F
Malware Config
Extracted
pony
http://tekinkgroup.com/rector/gate.php
-
payload_url
http://tekinkgroup.com/rector/shit.exe
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2668 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Order.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Order.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order.exedescription pid process target process PID 2976 set thread context of 2648 2976 Order.exe Order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
Order.exeOrder.exedescription pid process Token: SeDebugPrivilege 2976 Order.exe Token: SeImpersonatePrivilege 2648 Order.exe Token: SeTcbPrivilege 2648 Order.exe Token: SeChangeNotifyPrivilege 2648 Order.exe Token: SeCreateTokenPrivilege 2648 Order.exe Token: SeBackupPrivilege 2648 Order.exe Token: SeRestorePrivilege 2648 Order.exe Token: SeIncreaseQuotaPrivilege 2648 Order.exe Token: SeAssignPrimaryTokenPrivilege 2648 Order.exe Token: SeImpersonatePrivilege 2648 Order.exe Token: SeTcbPrivilege 2648 Order.exe Token: SeChangeNotifyPrivilege 2648 Order.exe Token: SeCreateTokenPrivilege 2648 Order.exe Token: SeBackupPrivilege 2648 Order.exe Token: SeRestorePrivilege 2648 Order.exe Token: SeIncreaseQuotaPrivilege 2648 Order.exe Token: SeAssignPrimaryTokenPrivilege 2648 Order.exe Token: SeImpersonatePrivilege 2648 Order.exe Token: SeTcbPrivilege 2648 Order.exe Token: SeChangeNotifyPrivilege 2648 Order.exe Token: SeCreateTokenPrivilege 2648 Order.exe Token: SeBackupPrivilege 2648 Order.exe Token: SeRestorePrivilege 2648 Order.exe Token: SeIncreaseQuotaPrivilege 2648 Order.exe Token: SeAssignPrimaryTokenPrivilege 2648 Order.exe Token: SeImpersonatePrivilege 2648 Order.exe Token: SeTcbPrivilege 2648 Order.exe Token: SeChangeNotifyPrivilege 2648 Order.exe Token: SeCreateTokenPrivilege 2648 Order.exe Token: SeBackupPrivilege 2648 Order.exe Token: SeRestorePrivilege 2648 Order.exe Token: SeIncreaseQuotaPrivilege 2648 Order.exe Token: SeAssignPrimaryTokenPrivilege 2648 Order.exe Token: SeRestorePrivilege 2648 Order.exe Token: SeBackupPrivilege 2648 Order.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Order.exeOrder.exedescription pid process target process PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2976 wrote to memory of 2648 2976 Order.exe Order.exe PID 2648 wrote to memory of 2668 2648 Order.exe cmd.exe PID 2648 wrote to memory of 2668 2648 Order.exe cmd.exe PID 2648 wrote to memory of 2668 2648 Order.exe cmd.exe PID 2648 wrote to memory of 2668 2648 Order.exe cmd.exe PID 2648 wrote to memory of 2668 2648 Order.exe cmd.exe PID 2648 wrote to memory of 2668 2648 Order.exe cmd.exe PID 2648 wrote to memory of 2668 2648 Order.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:2648 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\259410521.bat" "C:\Users\Admin\AppData\Local\Temp\Order.exe" "3⤵
- Deletes itself
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\259410521.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
memory/2648-23-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-9-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2648-4-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-21-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-2-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-7-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-32-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-3-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-19-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-17-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-15-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-13-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-11-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2648-1-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2976-0-0x00000000748B2000-0x00000000748B4000-memory.dmpFilesize
8KB