Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11-10-2022 08:03
General
-
Target
3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a.exe
-
Size
175KB
-
MD5
7d3ee4653a1ac1339911204351b802c8
-
SHA1
636b2a204836ae6e607bad2fbea2b5933d47cce7
-
SHA256
3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a
-
SHA512
09f130bd848b5e7bd3c24ca68e1d9ee3e428f95ab77275a2f2044f7aa916734283d65b119f3e93f07895615f8853f6ea65d73c6c1dfac98f1317f7a2a17c1d91
-
SSDEEP
3072:BKdg+BnVxOGLTBgUv45NWpWfcZZzZZBZZOZZHl4A:B+giO8TBgbNoWfcnznBnOnF7
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a.exe"C:\Users\Admin\AppData\Local\Temp\3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
180KB
-
Filesize
100KB
-
Filesize
180KB