Overview

overview

10

Static

static

c9220984b0...85.exe

windows7-x64

10

c9220984b0...85.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    254s
  • max time network
    284s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 05:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c9220984b02542258def3e0262662977b0c5da785f0c14ffe318cc8300c0fa85.exe

  • Size

    80KB

  • MD5

    a02384c9fff09d0a49469d05e6cbb57a

  • SHA1

    044486f2b47210539e2ccf6d51df4ca7fda676f6

  • SHA256

    c9220984b02542258def3e0262662977b0c5da785f0c14ffe318cc8300c0fa85

  • SHA512

    8472764fe48e03d18f3ff10967cf5eed0c75266bf27ec33d409ee394776ece550f1d7a5f28175bed24fba28bfe6b9e9d00e53db008c28b2f06afc2b806642080

  • SSDEEP

    1536:3fq6HEuN8BHbg3qAteHCOYAYUOuz0vXiIbYiVlV+Peu5ruBff4TGWIQ367o:FN8BH0MhWxXrV+mvBH4Th3

Score
10/10
ponydiscoverypersistenceratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://saleryplax.info:2346/pony/mac.php

http://derotins.info:2346/pony/mac.php

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Drops file in Drivers directory 3 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9220984b02542258def3e0262662977b0c5da785f0c14ffe318cc8300c0fa85.exe
    "C:\Users\Admin\AppData\Local\Temp\c9220984b02542258def3e0262662977b0c5da785f0c14ffe318cc8300c0fa85.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy %WINDIR%\system32\drivers\etc\hosts %WINDIR%\system32\drivers\etc\hosts.sam /Y && at 05:24:00 cmd.exe /c copy %TEMP%\240708671FdOh %WINDIR%\system32\drivers\etc\hosts /Y
      2⤵
      • Drops file in Drivers directory
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Windows\SysWOW64\at.exe
        at 05:24:00 cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\240708671FdOh C:\Windows\system32\drivers\etc\hosts /Y
        3⤵
          PID:4100
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 240736687 /t REG_SZ /d "cmd.exe /c copy %TEMP%\240708671FdOh %WINDIR%\system32\drivers\etc\hosts /Y && attrib +H %WINDIR%\system32\drivers\etc\hosts /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\reg.exe
          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 240736687 /t REG_SZ /d "cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\240708671FdOh C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts /f
          3⤵
          • Adds Run key to start application
          PID:4720
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ping -n 10 127.0.0.1 > NUL && del "C:\Users\Admin\AppData\Local\Temp\c9220984b02542258def3e0262662977b0c5da785f0c14ffe318cc8300c0fa85.exe"
        2⤵
          PID:1760

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1760-142-0x0000000000000000-mapping.dmp
        Download
      • memory/1836-138-0x0000000000000000-mapping.dmp
        Download
      • memory/2404-139-0x0000000000000000-mapping.dmp
        Download
      • memory/4100-140-0x0000000000000000-mapping.dmp
        Download
      • memory/4564-132-0x0000000000400000-0x0000000000431000-memory.dmp
        Filesize

        196KB

        Download
      • memory/4564-133-0x0000000000400000-0x0000000000431000-memory.dmp
        Filesize

        196KB

        Download
      • memory/4564-134-0x0000000000590000-0x00000000005C1000-memory.dmp
        Filesize

        196KB

        Download
      • memory/4564-135-0x0000000000400000-0x0000000000431000-memory.dmp
        Filesize

        196KB

        Download
      • memory/4564-136-0x0000000000590000-0x00000000005C1000-memory.dmp
        Filesize

        196KB

        Download
      • memory/4564-137-0x0000000000400000-0x0000000000431000-memory.dmp
        Filesize

        196KB

        Download
      • memory/4720-141-0x0000000000000000-mapping.dmp
        Download