Overview

overview

10

Static

static

4aceb5a4dc...2c.exe

windows7-x64

10

4aceb5a4dc...2c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    186s
  • max time network
    83s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 09:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c.exe

  • Size

    536KB

  • MD5

    943b7d1f31a9c27e6373e882540d5679

  • SHA1

    253b16ffeac084841944403e9ca3e6d9ab59dce3

  • SHA256

    4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c

  • SHA512

    9dba418e98e5931913c4609a3b28a1e96f1c0fe5ffd298ae5a73646eb08bdf5088f289bec9037a927207d429800b05e65f2c9142fcc22990bb31ece5590cfcbf

  • SSDEEP

    12288:Orr2iNZJymklR+um4cXwxHr7ypW4eSs1k2s5YqK7:W1dERbdcXg7aeSsQY9

Score
10/10
ponycollectiondiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://shuaacapitalae.com/js/gate.php

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c.exe
    "C:\Users\Admin\AppData\Local\Temp\4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:604
    • C:\Users\Admin\AppData\Local\Temp\4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c.exe
      "C:\Users\Admin\AppData\Local\Temp\4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c.exe"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      PID:2024
    • C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • outlook_win_path
          PID:960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
    Filesize

    536KB

    MD5

    943b7d1f31a9c27e6373e882540d5679

    SHA1

    253b16ffeac084841944403e9ca3e6d9ab59dce3

    SHA256

    4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c

    SHA512

    9dba418e98e5931913c4609a3b28a1e96f1c0fe5ffd298ae5a73646eb08bdf5088f289bec9037a927207d429800b05e65f2c9142fcc22990bb31ece5590cfcbf

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
    Filesize

    536KB

    MD5

    943b7d1f31a9c27e6373e882540d5679

    SHA1

    253b16ffeac084841944403e9ca3e6d9ab59dce3

    SHA256

    4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c

    SHA512

    9dba418e98e5931913c4609a3b28a1e96f1c0fe5ffd298ae5a73646eb08bdf5088f289bec9037a927207d429800b05e65f2c9142fcc22990bb31ece5590cfcbf

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
    Filesize

    536KB

    MD5

    943b7d1f31a9c27e6373e882540d5679

    SHA1

    253b16ffeac084841944403e9ca3e6d9ab59dce3

    SHA256

    4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c

    SHA512

    9dba418e98e5931913c4609a3b28a1e96f1c0fe5ffd298ae5a73646eb08bdf5088f289bec9037a927207d429800b05e65f2c9142fcc22990bb31ece5590cfcbf

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
    Filesize

    10KB

    MD5

    6a410982bb4017e1b38ff36752c6088a

    SHA1

    820786792bbdee074b624fa98871fac166811069

    SHA256

    7dec55e974bba8af142bfc25168f6bb077f9be3012149b6f4360ea2b97af584f

    SHA512

    4eab59cb10413b2772e187643855f03e366777c9b1dc9d12f984f50b1dd873a91ba0a1a2db872cc18920c23dceaaa635e08dc75b3ca48e49efb547dc9487159d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
    Filesize

    10KB

    MD5

    6a410982bb4017e1b38ff36752c6088a

    SHA1

    820786792bbdee074b624fa98871fac166811069

    SHA256

    7dec55e974bba8af142bfc25168f6bb077f9be3012149b6f4360ea2b97af584f

    SHA512

    4eab59cb10413b2772e187643855f03e366777c9b1dc9d12f984f50b1dd873a91ba0a1a2db872cc18920c23dceaaa635e08dc75b3ca48e49efb547dc9487159d

    Download Submit
  • \Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
    Filesize

    536KB

    MD5

    943b7d1f31a9c27e6373e882540d5679

    SHA1

    253b16ffeac084841944403e9ca3e6d9ab59dce3

    SHA256

    4aceb5a4dc7a4826f6167ba548de47a2bf1c2869edde551f53ceef13649ea02c

    SHA512

    9dba418e98e5931913c4609a3b28a1e96f1c0fe5ffd298ae5a73646eb08bdf5088f289bec9037a927207d429800b05e65f2c9142fcc22990bb31ece5590cfcbf

    Download Submit
  • \Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
    Filesize

    10KB

    MD5

    6a410982bb4017e1b38ff36752c6088a

    SHA1

    820786792bbdee074b624fa98871fac166811069

    SHA256

    7dec55e974bba8af142bfc25168f6bb077f9be3012149b6f4360ea2b97af584f

    SHA512

    4eab59cb10413b2772e187643855f03e366777c9b1dc9d12f984f50b1dd873a91ba0a1a2db872cc18920c23dceaaa635e08dc75b3ca48e49efb547dc9487159d

    Download Submit
  • memory/604-57-0x00000000744D0000-0x0000000074A7B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/604-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/604-55-0x00000000744D0000-0x0000000074A7B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/604-56-0x0000000000C06000-0x0000000000C17000-memory.dmp
    Filesize

    68KB

    Download
  • memory/916-87-0x00000000744D0000-0x0000000074A7B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/916-79-0x0000000000000000-mapping.dmp
    Download
  • memory/916-84-0x00000000744D0000-0x0000000074A7B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/916-85-0x0000000000906000-0x0000000000917000-memory.dmp
    Filesize

    68KB

    Download
  • memory/960-96-0x0000000000410CE5-mapping.dmp
    Download
  • memory/960-103-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/960-99-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/960-102-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/960-101-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/1392-71-0x0000000000000000-mapping.dmp
    Download
  • memory/1392-76-0x00000000744D0000-0x0000000074A7B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1392-83-0x00000000744D0000-0x0000000074A7B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/2024-64-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-82-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-75-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-86-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-68-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-66-0x0000000000410CE5-mapping.dmp
    Download
  • memory/2024-65-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-62-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-61-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-59-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2024-58-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

    Download