Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-06-2024 10:43
Behavioral task
behavioral1
Sample
payment advice.exe
Resource
win7-20240221-en
General
-
Target
payment advice.exe
-
Size
392KB
-
MD5
4a28ef4e797232288e853fec1faa25df
-
SHA1
0d752a5d84e669259cb3386914c94ca6ff65470a
-
SHA256
3c487a339e74d376137c0ffd86a0f6b693035f4b01f8844bbf1d09f0f9164d91
-
SHA512
174531188f089eb47d7a2e2fcaf3849202f22fff45871b231961142c793d9ca6276b57244d0f3b7a4183fe4a9b1ab4fe704b70206de61197d5d64805ab51f252
-
SSDEEP
12288:bltul+kX9phARKGOwm8HzjMA0Z6Ys+9lJI72pfWtGa:b72+kXeRhC6HMAOFLw2wn
Malware Config
Extracted
pony
http://theonlygoodman.com/ded/gate.php
-
payload_url
http://theonlygoodman.com/ded/ded.exe
Signatures
-
Deletes itself 1 IoCs
pid Process 2444 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1296-0-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1296-1-0x0000000000400000-0x00000000004CD000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts payment advice.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook payment advice.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1296 payment advice.exe Token: SeTcbPrivilege 1296 payment advice.exe Token: SeChangeNotifyPrivilege 1296 payment advice.exe Token: SeCreateTokenPrivilege 1296 payment advice.exe Token: SeBackupPrivilege 1296 payment advice.exe Token: SeRestorePrivilege 1296 payment advice.exe Token: SeIncreaseQuotaPrivilege 1296 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 1296 payment advice.exe Token: SeImpersonatePrivilege 1296 payment advice.exe Token: SeTcbPrivilege 1296 payment advice.exe Token: SeChangeNotifyPrivilege 1296 payment advice.exe Token: SeCreateTokenPrivilege 1296 payment advice.exe Token: SeBackupPrivilege 1296 payment advice.exe Token: SeRestorePrivilege 1296 payment advice.exe Token: SeIncreaseQuotaPrivilege 1296 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 1296 payment advice.exe Token: SeImpersonatePrivilege 1296 payment advice.exe Token: SeTcbPrivilege 1296 payment advice.exe Token: SeChangeNotifyPrivilege 1296 payment advice.exe Token: SeCreateTokenPrivilege 1296 payment advice.exe Token: SeBackupPrivilege 1296 payment advice.exe Token: SeRestorePrivilege 1296 payment advice.exe Token: SeIncreaseQuotaPrivilege 1296 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 1296 payment advice.exe Token: SeImpersonatePrivilege 1296 payment advice.exe Token: SeTcbPrivilege 1296 payment advice.exe Token: SeChangeNotifyPrivilege 1296 payment advice.exe Token: SeCreateTokenPrivilege 1296 payment advice.exe Token: SeBackupPrivilege 1296 payment advice.exe Token: SeRestorePrivilege 1296 payment advice.exe Token: SeIncreaseQuotaPrivilege 1296 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 1296 payment advice.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1296 payment advice.exe 1296 payment advice.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1296 wrote to memory of 2444 1296 payment advice.exe 29 PID 1296 wrote to memory of 2444 1296 payment advice.exe 29 PID 1296 wrote to memory of 2444 1296 payment advice.exe 29 PID 1296 wrote to memory of 2444 1296 payment advice.exe 29 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook payment advice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment advice.exe"C:\Users\Admin\AppData\Local\Temp\payment advice.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1296 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\259429225.bat" "C:\Users\Admin\AppData\Local\Temp\payment advice.exe" "2⤵
- Deletes itself
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b