Overview
overview
10Static
static
724.exe
windows7-x64
1024.exe
windows10-2004-x64
104.exe
windows7-x64
104.exe
windows10-2004-x64
107.exe
windows7-x64
107.exe
windows10-2004-x64
10Order.exe
windows7-x64
10Order.exe
windows10-2004-x64
10load2.exe
windows7-x64
load2.exe
windows10-2004-x64
spart.exe
windows7-x64
7spart.exe
windows10-2004-x64
7swift.exe
windows7-x64
10swift.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:00
Behavioral task
behavioral1
Sample
24.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
24.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
4.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
7.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Order.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Order.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
load2.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
load2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
spart.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
spart.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
swift.exe
Resource
win7-20240221-en
General
-
Target
Order.exe
-
Size
222KB
-
MD5
28ddb3f1013592bb1b4413ee39009a57
-
SHA1
17f9ae6d47506306352f9670c8dfed99322a3337
-
SHA256
c552c6df4bc0a5aff777c0d4c3b3aec0f2c042d68c17ecd316bfd58b04477698
-
SHA512
e96ab074f89cdd9e5ed94f279884eb4fbf44a1f9ca6da0e1507e0029df45c2f3c5b5ea9be62dc758f783d3ed26f0a98e15a67b5e2592cc872731739b0da05424
-
SSDEEP
6144:kdufqYEGgI+/bHmLpmTvnwM2mksSFwKQ:hqYEGgI+ymvwM29F
Malware Config
Extracted
pony
http://tekinkgroup.com/rector/gate.php
-
payload_url
http://tekinkgroup.com/rector/shit.exe
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Order.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Order.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Order.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order.exedescription pid process target process PID 900 set thread context of 4756 900 Order.exe Order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
Order.exeOrder.exedescription pid process Token: SeDebugPrivilege 900 Order.exe Token: SeImpersonatePrivilege 4756 Order.exe Token: SeTcbPrivilege 4756 Order.exe Token: SeChangeNotifyPrivilege 4756 Order.exe Token: SeCreateTokenPrivilege 4756 Order.exe Token: SeBackupPrivilege 4756 Order.exe Token: SeRestorePrivilege 4756 Order.exe Token: SeIncreaseQuotaPrivilege 4756 Order.exe Token: SeAssignPrimaryTokenPrivilege 4756 Order.exe Token: SeImpersonatePrivilege 4756 Order.exe Token: SeTcbPrivilege 4756 Order.exe Token: SeChangeNotifyPrivilege 4756 Order.exe Token: SeCreateTokenPrivilege 4756 Order.exe Token: SeBackupPrivilege 4756 Order.exe Token: SeRestorePrivilege 4756 Order.exe Token: SeIncreaseQuotaPrivilege 4756 Order.exe Token: SeAssignPrimaryTokenPrivilege 4756 Order.exe Token: SeImpersonatePrivilege 4756 Order.exe Token: SeTcbPrivilege 4756 Order.exe Token: SeChangeNotifyPrivilege 4756 Order.exe Token: SeCreateTokenPrivilege 4756 Order.exe Token: SeBackupPrivilege 4756 Order.exe Token: SeRestorePrivilege 4756 Order.exe Token: SeIncreaseQuotaPrivilege 4756 Order.exe Token: SeAssignPrimaryTokenPrivilege 4756 Order.exe Token: SeImpersonatePrivilege 4756 Order.exe Token: SeTcbPrivilege 4756 Order.exe Token: SeChangeNotifyPrivilege 4756 Order.exe Token: SeCreateTokenPrivilege 4756 Order.exe Token: SeBackupPrivilege 4756 Order.exe Token: SeRestorePrivilege 4756 Order.exe Token: SeIncreaseQuotaPrivilege 4756 Order.exe Token: SeAssignPrimaryTokenPrivilege 4756 Order.exe Token: SeImpersonatePrivilege 4756 Order.exe Token: SeTcbPrivilege 4756 Order.exe Token: SeChangeNotifyPrivilege 4756 Order.exe Token: SeCreateTokenPrivilege 4756 Order.exe Token: SeBackupPrivilege 4756 Order.exe Token: SeRestorePrivilege 4756 Order.exe Token: SeIncreaseQuotaPrivilege 4756 Order.exe Token: SeAssignPrimaryTokenPrivilege 4756 Order.exe Token: SeImpersonatePrivilege 4756 Order.exe Token: SeTcbPrivilege 4756 Order.exe Token: SeChangeNotifyPrivilege 4756 Order.exe Token: SeCreateTokenPrivilege 4756 Order.exe Token: SeBackupPrivilege 4756 Order.exe Token: SeRestorePrivilege 4756 Order.exe Token: SeIncreaseQuotaPrivilege 4756 Order.exe Token: SeAssignPrimaryTokenPrivilege 4756 Order.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Order.exeOrder.exedescription pid process target process PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 900 wrote to memory of 4756 900 Order.exe Order.exe PID 4756 wrote to memory of 4624 4756 Order.exe cmd.exe PID 4756 wrote to memory of 4624 4756 Order.exe cmd.exe PID 4756 wrote to memory of 4624 4756 Order.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240606734.bat" "C:\Users\Admin\AppData\Local\Temp\Order.exe" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\240606734.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
memory/900-0-0x0000000075052000-0x0000000075053000-memory.dmpFilesize
4KB
-
memory/900-1-0x0000000075050000-0x0000000075601000-memory.dmpFilesize
5.7MB
-
memory/900-2-0x0000000075050000-0x0000000075601000-memory.dmpFilesize
5.7MB
-
memory/900-7-0x0000000075050000-0x0000000075601000-memory.dmpFilesize
5.7MB
-
memory/4756-3-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/4756-6-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/4756-11-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB