Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
22/03/2021, 09:11
General
- Target 0AFE6EF393024CA44FFBAB115FB14114.exe
- Size 91KB
- Sample210322-y7bcpgrjs2
- SHA256 8bd366c118d422bec6f429e01f24a1b48a4f6a3c2a426e606f0b732bbf457aaf
Score
10/10
Malware Config
Signatures
- Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0AFE6EF393024CA44FFBAB115FB14114.exe"C:\Users\Admin\AppData\Local\Temp\0AFE6EF393024CA44FFBAB115FB14114.exe"1⤵
- Suspicious use of AdjustPrivilegeToken