Overview

overview

10

Static

static

3

8A27978322...85.exe

windows7-x64

10

8A27978322...85.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2023 17:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8A279783229E688A2324C224904473431CC5CAB7E6B85.exe

  • Size

    466KB

  • MD5

    2d8f60c9459f321d765ce1e50e49f41a

  • SHA1

    15797084c07f8ce0ef427fd868a81ab95b10f549

  • SHA256

    8a279783229e688a2324c224904473431cc5cab7e6b8538ac8256877cfd58384

  • SHA512

    c076c9588d48ded127c753d8d5e9d321535111042f97c286dc41711af86d02beeeec28b6a08de1d413462d9a5c7b4d20981d1327a5ecc4a5e04dba7edbb72b70

  • SSDEEP

    12288:jHZKdRVIZcXwxHr7ypW4eSs1k2s5YqK7:FumcXg7aeSsQY9

Score
10/10
ponycollectiondiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://roadstar.comeze.com/chinedu/gate.php

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8A279783229E688A2324C224904473431CC5CAB7E6B85.exe
    "C:\Users\Admin\AppData\Local\Temp\8A279783229E688A2324C224904473431CC5CAB7E6B85.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Users\Admin\AppData\Local\Temp\8A279783229E688A2324C224904473431CC5CAB7E6B85.exe
      "C:\Users\Admin\AppData\Local\Temp\8A279783229E688A2324C224904473431CC5CAB7E6B85.exe"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      PID:2024
    • C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4768
      • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:212
        • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • outlook_win_path
          PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
    Filesize

    466KB

    MD5

    2d8f60c9459f321d765ce1e50e49f41a

    SHA1

    15797084c07f8ce0ef427fd868a81ab95b10f549

    SHA256

    8a279783229e688a2324c224904473431cc5cab7e6b8538ac8256877cfd58384

    SHA512

    c076c9588d48ded127c753d8d5e9d321535111042f97c286dc41711af86d02beeeec28b6a08de1d413462d9a5c7b4d20981d1327a5ecc4a5e04dba7edbb72b70

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
    Filesize

    466KB

    MD5

    2d8f60c9459f321d765ce1e50e49f41a

    SHA1

    15797084c07f8ce0ef427fd868a81ab95b10f549

    SHA256

    8a279783229e688a2324c224904473431cc5cab7e6b8538ac8256877cfd58384

    SHA512

    c076c9588d48ded127c753d8d5e9d321535111042f97c286dc41711af86d02beeeec28b6a08de1d413462d9a5c7b4d20981d1327a5ecc4a5e04dba7edbb72b70

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe
    Filesize

    466KB

    MD5

    2d8f60c9459f321d765ce1e50e49f41a

    SHA1

    15797084c07f8ce0ef427fd868a81ab95b10f549

    SHA256

    8a279783229e688a2324c224904473431cc5cab7e6b8538ac8256877cfd58384

    SHA512

    c076c9588d48ded127c753d8d5e9d321535111042f97c286dc41711af86d02beeeec28b6a08de1d413462d9a5c7b4d20981d1327a5ecc4a5e04dba7edbb72b70

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
    Filesize

    9KB

    MD5

    261fc7ece0f6555f9632b1898f107f29

    SHA1

    dd8dcc25e5a777c323ce0c745f31d427f17b184f

    SHA256

    86be12e7a264ae36af435dad626138523614da93bb803c260890601bd617ec74

    SHA512

    4fb6163e453202140d44aae22289aa80efa42c7d9214004ddc65400b1468145788b0331e8be6b78e1acbc9d197d3a51dc9e75809632ad4c204e49b835deda303

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
    Filesize

    9KB

    MD5

    261fc7ece0f6555f9632b1898f107f29

    SHA1

    dd8dcc25e5a777c323ce0c745f31d427f17b184f

    SHA256

    86be12e7a264ae36af435dad626138523614da93bb803c260890601bd617ec74

    SHA512

    4fb6163e453202140d44aae22289aa80efa42c7d9214004ddc65400b1468145788b0331e8be6b78e1acbc9d197d3a51dc9e75809632ad4c204e49b835deda303

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe
    Filesize

    9KB

    MD5

    261fc7ece0f6555f9632b1898f107f29

    SHA1

    dd8dcc25e5a777c323ce0c745f31d427f17b184f

    SHA256

    86be12e7a264ae36af435dad626138523614da93bb803c260890601bd617ec74

    SHA512

    4fb6163e453202140d44aae22289aa80efa42c7d9214004ddc65400b1468145788b0331e8be6b78e1acbc9d197d3a51dc9e75809632ad4c204e49b835deda303

    Download Submit
  • memory/212-157-0x0000000001260000-0x0000000001270000-memory.dmp
    Filesize

    64KB

    Download
  • memory/212-156-0x0000000001260000-0x0000000001270000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1668-163-0x0000000000400000-0x0000000000416000-memory.dmp
    Filesize

    88KB

    Download
  • memory/1668-162-0x0000000000400000-0x0000000000416000-memory.dmp
    Filesize

    88KB

    Download
  • memory/2024-140-0x0000000000400000-0x0000000000416000-memory.dmp
    Filesize

    88KB

    Download
  • memory/2024-152-0x0000000000400000-0x0000000000416000-memory.dmp
    Filesize

    88KB

    Download
  • memory/2024-139-0x0000000000400000-0x0000000000416000-memory.dmp
    Filesize

    88KB

    Download
  • memory/2024-137-0x0000000000400000-0x0000000000416000-memory.dmp
    Filesize

    88KB

    Download
  • memory/3248-133-0x00000000017C0000-0x00000000017D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3248-134-0x00000000017C0000-0x00000000017D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4768-153-0x00000000012B0000-0x00000000012C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4768-151-0x00000000012B0000-0x00000000012C0000-memory.dmp
    Filesize

    64KB

    Download