Analysis
-
max time kernel
128s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 10:43
Behavioral task
behavioral1
Sample
payment advice.exe
Resource
win7-20240221-en
General
-
Target
payment advice.exe
-
Size
392KB
-
MD5
4a28ef4e797232288e853fec1faa25df
-
SHA1
0d752a5d84e669259cb3386914c94ca6ff65470a
-
SHA256
3c487a339e74d376137c0ffd86a0f6b693035f4b01f8844bbf1d09f0f9164d91
-
SHA512
174531188f089eb47d7a2e2fcaf3849202f22fff45871b231961142c793d9ca6276b57244d0f3b7a4183fe4a9b1ab4fe704b70206de61197d5d64805ab51f252
-
SSDEEP
12288:bltul+kX9phARKGOwm8HzjMA0Z6Ys+9lJI72pfWtGa:b72+kXeRhC6HMAOFLw2wn
Malware Config
Extracted
pony
http://theonlygoodman.com/ded/gate.php
-
payload_url
http://theonlygoodman.com/ded/ded.exe
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation payment advice.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3344-0-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/3344-1-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/3344-3-0x0000000000400000-0x00000000004CD000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts payment advice.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook payment advice.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 3344 payment advice.exe Token: SeTcbPrivilege 3344 payment advice.exe Token: SeChangeNotifyPrivilege 3344 payment advice.exe Token: SeCreateTokenPrivilege 3344 payment advice.exe Token: SeBackupPrivilege 3344 payment advice.exe Token: SeRestorePrivilege 3344 payment advice.exe Token: SeIncreaseQuotaPrivilege 3344 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 3344 payment advice.exe Token: SeImpersonatePrivilege 3344 payment advice.exe Token: SeTcbPrivilege 3344 payment advice.exe Token: SeChangeNotifyPrivilege 3344 payment advice.exe Token: SeCreateTokenPrivilege 3344 payment advice.exe Token: SeBackupPrivilege 3344 payment advice.exe Token: SeRestorePrivilege 3344 payment advice.exe Token: SeIncreaseQuotaPrivilege 3344 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 3344 payment advice.exe Token: SeImpersonatePrivilege 3344 payment advice.exe Token: SeTcbPrivilege 3344 payment advice.exe Token: SeChangeNotifyPrivilege 3344 payment advice.exe Token: SeCreateTokenPrivilege 3344 payment advice.exe Token: SeBackupPrivilege 3344 payment advice.exe Token: SeRestorePrivilege 3344 payment advice.exe Token: SeIncreaseQuotaPrivilege 3344 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 3344 payment advice.exe Token: SeImpersonatePrivilege 3344 payment advice.exe Token: SeTcbPrivilege 3344 payment advice.exe Token: SeChangeNotifyPrivilege 3344 payment advice.exe Token: SeCreateTokenPrivilege 3344 payment advice.exe Token: SeBackupPrivilege 3344 payment advice.exe Token: SeRestorePrivilege 3344 payment advice.exe Token: SeIncreaseQuotaPrivilege 3344 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 3344 payment advice.exe Token: SeImpersonatePrivilege 3344 payment advice.exe Token: SeTcbPrivilege 3344 payment advice.exe Token: SeChangeNotifyPrivilege 3344 payment advice.exe Token: SeCreateTokenPrivilege 3344 payment advice.exe Token: SeBackupPrivilege 3344 payment advice.exe Token: SeRestorePrivilege 3344 payment advice.exe Token: SeIncreaseQuotaPrivilege 3344 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 3344 payment advice.exe Token: SeImpersonatePrivilege 3344 payment advice.exe Token: SeTcbPrivilege 3344 payment advice.exe Token: SeChangeNotifyPrivilege 3344 payment advice.exe Token: SeCreateTokenPrivilege 3344 payment advice.exe Token: SeBackupPrivilege 3344 payment advice.exe Token: SeRestorePrivilege 3344 payment advice.exe Token: SeIncreaseQuotaPrivilege 3344 payment advice.exe Token: SeAssignPrimaryTokenPrivilege 3344 payment advice.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3344 payment advice.exe 3344 payment advice.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3344 wrote to memory of 2380 3344 payment advice.exe 89 PID 3344 wrote to memory of 2380 3344 payment advice.exe 89 PID 3344 wrote to memory of 2380 3344 payment advice.exe 89 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook payment advice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment advice.exe"C:\Users\Admin\AppData\Local\Temp\payment advice.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240634203.bat" "C:\Users\Admin\AppData\Local\Temp\payment advice.exe" "2⤵PID:2380
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b