Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2024 20:56
Static task
static1
Behavioral task
behavioral1
Sample
6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe
Resource
win10v2004-20241007-en
General
-
Target
6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe
-
Size
97KB
-
MD5
5ddcce9c319d9dcdcf51bc600d163210
-
SHA1
76a256858050012a4bfb6453d8ae644c3b012b97
-
SHA256
6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9e
-
SHA512
51ffa8177a18ad4dff20005cbb8c41996b68cb5117e29818774bea7364230df1a3eef9a1572104cc5bdcbb20b84640111c5dc8d94afa8859b8fcb800ed430170
-
SSDEEP
1536:L4mQaw69uWYuM0PXxe4/ZdX0P4AC7k0SoaeWQZUNkPww+Me3wMWx+Sii:LfYhIxe4/ZdX0PB6VnaIWNpbwcS
Malware Config
Extracted
pony
http://tjrtruj.pw:4915/doc/black.php
http://mtfaudj.pw:888/doc/black.php
-
payload_url
http://fkewryu.pw:888/pic/Flash.exe
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts.sam cmd.exe File created C:\Windows\system32\drivers\etc\tmp.tmp 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe File created C:\Windows\system32\drivers\etc\hosts.sam cmd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
pid Process 884 cmd.exe 1116 at.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 944 cmd.exe 3564 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3564 PING.EXE -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeTcbPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeChangeNotifyPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeCreateTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeBackupPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeRestorePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeIncreaseQuotaPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeAssignPrimaryTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeImpersonatePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeTcbPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeChangeNotifyPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeCreateTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeBackupPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeRestorePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeIncreaseQuotaPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeAssignPrimaryTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeImpersonatePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeTcbPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeChangeNotifyPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeCreateTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeBackupPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeRestorePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeIncreaseQuotaPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeAssignPrimaryTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeImpersonatePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeTcbPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeChangeNotifyPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeCreateTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeBackupPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeRestorePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeIncreaseQuotaPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeAssignPrimaryTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeImpersonatePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeTcbPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeChangeNotifyPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeCreateTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeBackupPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeRestorePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeIncreaseQuotaPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeAssignPrimaryTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeImpersonatePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeTcbPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeChangeNotifyPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeCreateTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeBackupPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeRestorePrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeIncreaseQuotaPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe Token: SeAssignPrimaryTokenPrivilege 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4480 wrote to memory of 884 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe 98 PID 4480 wrote to memory of 884 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe 98 PID 4480 wrote to memory of 884 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe 98 PID 4480 wrote to memory of 944 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe 100 PID 4480 wrote to memory of 944 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe 100 PID 4480 wrote to memory of 944 4480 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe 100 PID 884 wrote to memory of 1116 884 cmd.exe 102 PID 884 wrote to memory of 1116 884 cmd.exe 102 PID 884 wrote to memory of 1116 884 cmd.exe 102 PID 944 wrote to memory of 3564 944 cmd.exe 103 PID 944 wrote to memory of 3564 944 cmd.exe 103 PID 944 wrote to memory of 3564 944 cmd.exe 103 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe"C:\Users\Admin\AppData\Local\Temp\6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:4480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\drivers\etc\hosts C:\Windows\system32\drivers\etc\hosts.sam /Y && at 21:02:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240649390aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"2⤵
- Drops file in Drivers directory
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\at.exeat 21:02:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240649390aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"3⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
PID:1116
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 6 localhost && erase "C:\Users\Admin\AppData\Local\Temp\6074dbcd202fe85dab4f258f6d6a5a0b27d9fc72216b015d70d5648f07e76b9eN.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\PING.EXEping -n 6 localhost3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3564
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3