Malware Analysis Report

2025-08-05 13:10

Sample ID 221120-j4shdsdg68
Target 88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980
SHA256 88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980
Tags
pony discovery rat spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980

Threat Level: Known bad

The file 88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980 was found to be: Known bad.

Malicious Activity Summary

pony discovery rat spyware stealer upx

Pony,Fareit

UPX packed file

Reads data files stored by FTP clients

Deletes itself

Reads user/profile data of web browsers

Checks installed software on the system

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-20 08:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-20 08:13

Reported

2022-11-20 08:16

Platform

win7-20221111-en

Max time kernel

49s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe"

Signatures

Pony,Fareit

rat spyware stealer pony

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1308 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe
PID 1336 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe

"C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe"

C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe

"C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\7126141.bat" "C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe" "

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 www.abogadosiriarte.com udp
N/A 65.60.53.42:80 www.abogadosiriarte.com tcp
N/A 65.60.53.42:80 www.abogadosiriarte.com tcp
N/A 65.60.53.42:80 www.abogadosiriarte.com tcp
N/A 65.60.53.42:80 www.abogadosiriarte.com tcp
N/A 8.8.8.8:53 www.azucarnatural.com udp
N/A 23.111.168.154:80 www.azucarnatural.com tcp
N/A 23.111.168.154:80 www.azucarnatural.com tcp
N/A 23.111.168.154:80 www.azucarnatural.com tcp
N/A 23.111.168.154:80 www.azucarnatural.com tcp

Files

memory/1336-54-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/1336-55-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/1336-58-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/1336-57-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/1336-59-0x00000000004D36F0-mapping.dmp

memory/1308-60-0x0000000000400000-0x0000000000422000-memory.dmp

memory/1336-62-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/1336-63-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/1336-64-0x0000000075931000-0x0000000075933000-memory.dmp

memory/1336-65-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/1336-66-0x0000000000400000-0x00000000004D5000-memory.dmp

memory/896-67-0x0000000000000000-mapping.dmp

memory/1336-68-0x0000000000400000-0x00000000004D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7126141.bat

MD5 3880eeb1c736d853eb13b44898b718ab
SHA1 4eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256 936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA512 3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-20 08:13

Reported

2022-11-20 08:16

Platform

win10v2004-20220901-en

Max time kernel

91s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe

"C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe"

C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe

"C:\Users\Admin\AppData\Local\Temp\88415a4a3370cfb5351044cf69c1652ee196cfb31793eac350be3ce0fe7f4980.exe"

Network

Country Destination Domain Proto
N/A 93.184.221.240:80 tcp
N/A 104.80.225.205:443 tcp
N/A 51.132.193.104:443 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp

Files

memory/1336-135-0x0000000000400000-0x0000000000422000-memory.dmp

memory/372-136-0x0000000000000000-mapping.dmp

memory/1336-137-0x0000000000400000-0x0000000000422000-memory.dmp