Overview

overview

10

Static

static

eda6bc2779...ca.exe

windows7_x64

10

eda6bc2779...ca.exe

windows10_x64

10

Analysis

  • max time kernel
    92s
  • max time network
    97s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    09-07-2020 18:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eda6bc27798b7230d63cae9225c466b67b05e788b315e4dc443c43cf1baabfca.exe

  • Size

    1.1MB

  • MD5

    b70279fc1c857dc76a50f77a46460657

  • SHA1

    fbcabd564c13287b0a0d42026c77006f0c6e7983

  • SHA256

    eda6bc27798b7230d63cae9225c466b67b05e788b315e4dc443c43cf1baabfca

  • SHA512

    424726d9175411466cb5fb0d99ecb843fb9609506b88e708c13717d5b47921485c370324b08f3f5379b6e7b2266ae30e45f49a6030ad2409446ec971ddbd761f

Score
10/10
spywarediscoveryratstealerpony

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
    spyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks for installed software on the system 1 TTPs 7 IoCs
    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\eda6bc27798b7230d63cae9225c466b67b05e788b315e4dc443c43cf1baabfca.exe
    "C:\Users\Admin\AppData\Local\Temp\eda6bc27798b7230d63cae9225c466b67b05e788b315e4dc443c43cf1baabfca.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Users\Admin\AppData\Local\Temp\eda6bc27798b7230d63cae9225c466b67b05e788b315e4dc443c43cf1baabfca.exe
      C:\Users\Admin\AppData\Local\Temp\eda6bc27798b7230d63cae9225c466b67b05e788b315e4dc443c43cf1baabfca.exe dfsr
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • Checks for installed software on the system
      PID:3836
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\Admin\AppData\Local\Temp\eda6bc27798b7230d63cae9225c466b67b05e788b315e4dc443c43cf1baabfca.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:4064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Remote System Discovery

1
T1018

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3836-0-0x0000000000000000-mapping.dmp
    Download
  • memory/3836-1-0x0000000003010000-0x000000000302C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/3956-2-0x0000000000000000-mapping.dmp
    Download
  • memory/4064-3-0x0000000000000000-mapping.dmp
    Download