Analysis
- max time kernel
16s - max time network
68s - platform
windows10_x64 - resource
win10v20210408 - submitted
15/07/2021, 17:41
General
- Target 57933BC5C60DE83FDDBC7A2C6522E6481C9E684E342FE.exe
- Size 1.2MB
- Sample210715-9fyphbakqs
- SHA256 57933bc5c60de83fddbc7a2c6522e6481c9e684e342fed86a4c38bf08c4a6b0f
Malware Config
Extracted
-
pony
-
http://www.ptsinar.co/ymg/apisiylo/gate.php
-
payload_url
http://www.ptsinar.co/ymg/apisiylo/shit.exe
Signatures
- Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Executes dropped EXE 2 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\57933BC5C60DE83FDDBC7A2C6522E6481C9E684E342FE.exe"C:\Users\Admin\AppData\Local\Temp\57933BC5C60DE83FDDBC7A2C6522E6481C9E684E342FE.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Resm1.exe"C:\Users\Admin\AppData\Local\Temp\Resm1.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Resm1.exe"C:\Users\Admin\AppData\Local\Temp\Resm1.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259296984.bat" "C:\Users\Admin\AppData\Local\Temp\Resm1.exe" "4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/756-138-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-163-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/756-117-0x0000000002230000-0x0000000002290000-memory.dmp
memory/756-119-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/756-121-0x00000000025E0000-0x00000000025E1000-memory.dmp
memory/756-120-0x0000000002650000-0x0000000002651000-memory.dmp
memory/756-124-0x0000000002660000-0x0000000002661000-memory.dmp
memory/756-122-0x0000000002670000-0x0000000002671000-memory.dmp
memory/756-123-0x0000000002620000-0x0000000002621000-memory.dmp
memory/756-126-0x0000000003310000-0x0000000003311000-memory.dmp
memory/756-125-0x0000000002640000-0x0000000002641000-memory.dmp
memory/756-128-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-127-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-130-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-129-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-132-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/756-131-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/756-134-0x0000000002400000-0x0000000002401000-memory.dmp
memory/756-133-0x0000000002430000-0x0000000002431000-memory.dmp
memory/756-136-0x0000000002440000-0x0000000002441000-memory.dmp
memory/756-135-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/756-145-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/756-139-0x0000000002540000-0x0000000002541000-memory.dmp
memory/756-141-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/756-140-0x0000000002530000-0x0000000002531000-memory.dmp
memory/756-118-0x0000000002600000-0x0000000002601000-memory.dmp
memory/756-143-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/756-137-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-144-0x0000000002560000-0x0000000002561000-memory.dmp
memory/756-147-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-146-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-149-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-148-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-151-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/756-150-0x0000000003300000-0x0000000003301000-memory.dmp
memory/756-153-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/756-152-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/756-155-0x0000000002690000-0x0000000002691000-memory.dmp
memory/756-154-0x0000000002700000-0x0000000002701000-memory.dmp
memory/756-157-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/756-156-0x0000000002720000-0x0000000002721000-memory.dmp
memory/756-158-0x0000000002710000-0x0000000002711000-memory.dmp
memory/756-160-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/756-159-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/756-161-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/756-162-0x0000000002460000-0x0000000002461000-memory.dmp
memory/756-142-0x0000000002520000-0x0000000002521000-memory.dmp
memory/756-164-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/3116-166-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3116-169-0x0000000000400000-0x0000000000419000-memory.dmp