Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
-
Size
160KB
-
MD5
50372b8bc598758fd5d85102172a3735
-
SHA1
3be32de76798e152dd199984c6941055f544f411
-
SHA256
d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046
-
SHA512
e825b2d28940bc5a0a95b8ea9c4a0c12a8611fd014199ccf31d74c35b66f185160a313e7c1f3707afaeaaadc87efde3922b101365a353b14a73af1f850f96bec
-
SSDEEP
3072:jik8/Lfyzvm6Rf6Omn/0sX096MGUlR4WjK:G/LqzBwzcsXXMDBu
Malware Config
Extracted
Family
pony
C2
http://jokeplek.pw/gate.php
http://vodalix.pw/gate.php
Signatures
-
Pony family
-
Deletes itself 1 IoCs
pid Process 2496 svchost.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 37.10.116.208 -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts svchost.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook svchost.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsMonitorConfigs32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemDriversReserved\\figixumu.exe\"" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1992 set thread context of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 -
resource yara_rule behavioral1/memory/2496-10-0x0000000000800000-0x0000000000820000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2692 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 2692 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2804 WMIC.exe Token: SeSecurityPrivilege 2804 WMIC.exe Token: SeTakeOwnershipPrivilege 2804 WMIC.exe Token: SeLoadDriverPrivilege 2804 WMIC.exe Token: SeSystemProfilePrivilege 2804 WMIC.exe Token: SeSystemtimePrivilege 2804 WMIC.exe Token: SeProfSingleProcessPrivilege 2804 WMIC.exe Token: SeIncBasePriorityPrivilege 2804 WMIC.exe Token: SeCreatePagefilePrivilege 2804 WMIC.exe Token: SeBackupPrivilege 2804 WMIC.exe Token: SeRestorePrivilege 2804 WMIC.exe Token: SeShutdownPrivilege 2804 WMIC.exe Token: SeDebugPrivilege 2804 WMIC.exe Token: SeSystemEnvironmentPrivilege 2804 WMIC.exe Token: SeRemoteShutdownPrivilege 2804 WMIC.exe Token: SeUndockPrivilege 2804 WMIC.exe Token: SeManageVolumePrivilege 2804 WMIC.exe Token: 33 2804 WMIC.exe Token: 34 2804 WMIC.exe Token: 35 2804 WMIC.exe Token: SeIncreaseQuotaPrivilege 2804 WMIC.exe Token: SeSecurityPrivilege 2804 WMIC.exe Token: SeTakeOwnershipPrivilege 2804 WMIC.exe Token: SeLoadDriverPrivilege 2804 WMIC.exe Token: SeSystemProfilePrivilege 2804 WMIC.exe Token: SeSystemtimePrivilege 2804 WMIC.exe Token: SeProfSingleProcessPrivilege 2804 WMIC.exe Token: SeIncBasePriorityPrivilege 2804 WMIC.exe Token: SeCreatePagefilePrivilege 2804 WMIC.exe Token: SeBackupPrivilege 2804 WMIC.exe Token: SeRestorePrivilege 2804 WMIC.exe Token: SeShutdownPrivilege 2804 WMIC.exe Token: SeDebugPrivilege 2804 WMIC.exe Token: SeSystemEnvironmentPrivilege 2804 WMIC.exe Token: SeRemoteShutdownPrivilege 2804 WMIC.exe Token: SeUndockPrivilege 2804 WMIC.exe Token: SeManageVolumePrivilege 2804 WMIC.exe Token: 33 2804 WMIC.exe Token: 34 2804 WMIC.exe Token: 35 2804 WMIC.exe Token: SeImpersonatePrivilege 2496 svchost.exe Token: SeTcbPrivilege 2496 svchost.exe Token: SeChangeNotifyPrivilege 2496 svchost.exe Token: SeCreateTokenPrivilege 2496 svchost.exe Token: SeBackupPrivilege 2496 svchost.exe Token: SeRestorePrivilege 2496 svchost.exe Token: SeIncreaseQuotaPrivilege 2496 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2496 svchost.exe Token: SeImpersonatePrivilege 2496 svchost.exe Token: SeTcbPrivilege 2496 svchost.exe Token: SeChangeNotifyPrivilege 2496 svchost.exe Token: SeCreateTokenPrivilege 2496 svchost.exe Token: SeBackupPrivilege 2496 svchost.exe Token: SeRestorePrivilege 2496 svchost.exe Token: SeIncreaseQuotaPrivilege 2496 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2496 svchost.exe Token: SeImpersonatePrivilege 2496 svchost.exe Token: SeTcbPrivilege 2496 svchost.exe Token: SeChangeNotifyPrivilege 2496 svchost.exe Token: SeCreateTokenPrivilege 2496 svchost.exe Token: SeBackupPrivilege 2496 svchost.exe Token: SeRestorePrivilege 2496 svchost.exe Token: SeIncreaseQuotaPrivilege 2496 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2496 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 1992 wrote to memory of 2692 1992 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 30 PID 2692 wrote to memory of 2496 2692 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 31 PID 2692 wrote to memory of 2496 2692 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 31 PID 2692 wrote to memory of 2496 2692 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 31 PID 2692 wrote to memory of 2496 2692 d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe 31 PID 2496 wrote to memory of 2804 2496 svchost.exe 32 PID 2496 wrote to memory of 2804 2496 svchost.exe 32 PID 2496 wrote to memory of 2804 2496 svchost.exe 32 PID 2496 wrote to memory of 2804 2496 svchost.exe 32 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe"C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe"C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Deletes itself
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:2496 -
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" nicconfig where IPEnabled=true call SetDNSServerSearchOrder (37.10.116.208,8.8.4.4)4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
-