Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
28-10-2021 16:37
Static task
static1
Behavioral task
behavioral1
Sample
AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe
Resource
win7-en-20210920
General
-
Target
AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe
-
Size
132KB
-
MD5
7da0c504b12418fb839d87140818db86
-
SHA1
62df5ab21fdce64587af336036b7415842ee8eaa
-
SHA256
ac71a4c514e59461dc4987a54704e1f1d7e9dced054acfca7758d55cc8e4964f
-
SHA512
a90d34045ad7f2c785b8e795250004874c08908e26143cfe667f2f1d899b8d85eddcc978ee3d150df3225983e1c9e8d8bfb0111982017ef3d43269a1af30dd47
Malware Config
Extracted
pony
http://yourdentalfirst.com/wp-includes/SimplePie/SimplePie.php
http://zoemeiresort.com/wp-includes/pomo/pomo.php
http://www.hummingbirdhamlet.com/wp-content/upgrade/upgrade.php
http://www.icleanthescene.com/wp-content/blogs.dir/blogs.dir.php
http://www.iconicglam.com/wp-admin/network/extension.php
http://www.neapolismessina.com/_oldsite/imggallery/lxpxj.php
http://www.realdealutah.com/wp-contents/themes/themes.php
http://www.techsiara.com/wp-includes/SimplePie/SimplePie.php
http://aycenergy.com/wp/wp-admin/navigation.php
Signatures
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exedescription pid process Token: SeImpersonatePrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe Token: SeTcbPrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe Token: SeChangeNotifyPrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe Token: SeCreateTokenPrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe Token: SeBackupPrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe Token: SeRestorePrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe Token: SeIncreaseQuotaPrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe Token: SeAssignPrimaryTokenPrivilege 3144 AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe -
outlook_win_path 1 IoCs
Processes:
AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe"C:\Users\Admin\AppData\Local\Temp\AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3144-115-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB