Overview

overview

10

Static

static

10

79a831d07f...34.exe

windows7_x64

10

79a831d07f...34.exe

windows10_x64

10

Analysis

  • max time kernel
    13s
  • max time network
    74s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    05-07-2021 06:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79a831d07f9c62238d8177e6bbed796f3501545b43bfd1c8b1e0736940ec6434.exe

  • Size

    97KB

  • MD5

    acfeeb53f8813a9789271973871f9c13

  • SHA1

    05e1139fd1fa81f1db14432c6e3399dc7aa07bb5

  • SHA256

    79a831d07f9c62238d8177e6bbed796f3501545b43bfd1c8b1e0736940ec6434

  • SHA512

    a4505ac6d73d9133bd22e3b62765c63eb43249ae16c6bc3757623e29fa16a676129186ee5d8106427c61224c616182ec38105692411f86fa9adf8967e6b12a4c

Score
10/10
ponydiscoveryratspywarestealer

Malware Config

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79a831d07f9c62238d8177e6bbed796f3501545b43bfd1c8b1e0736940ec6434.exe
    "C:\Users\Admin\AppData\Local\Temp\79a831d07f9c62238d8177e6bbed796f3501545b43bfd1c8b1e0736940ec6434.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads