Overview

overview

10

Static

static

3

16f0f3dac1...99.exe

windows7-x64

10

16f0f3dac1...99.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2023 02:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599.exe

  • Size

    56KB

  • MD5

    f6536f7fe9feef17adc493638395555b

  • SHA1

    157307ead7905b1844dcc69458f0531e66b31fb6

  • SHA256

    16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599

  • SHA512

    5313d816e2aba0c2f9a2627ed8f1a7507aec05d7f7089a51307743bb215b1fe15e1596699f3b092dc117a5fcf21772a38ce326be8c917ba9aa1fe2492df96da3

  • SSDEEP

    1536:+tzqxvhrplLk9h8egJPfWunoGh4R17mZDLn845OUKMkQKFoNek+5UD:+T8N3WuoGh4KZDL1gmKF0ek+M

Score
10/10
ponycollectiondiscoveryratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://sunelec-kk.com/tmp/r1.php

http://japmotors.net/tmp/r1.php
Attributes
  • payload_url

    http://globalofficesolution.net/tmp/file1.exe

    http://globalofficesolution.net/tmp/file2.exe

    http://davesclassics.com.au/tmp/file1.exe

    http://davesclassics.com.au/tmp/file2.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599.exe
    "C:\Users\Admin\AppData\Local\Temp\16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599.exe
      "C:\Users\Admin\AppData\Local\Temp\16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599.exe"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_win_path
      PID:1340
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240599687.bat" "C:\Users\Admin\AppData\Local\Temp\16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599.exe" "
        3⤵
          PID:3004

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Email Collection

    2
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\240596468.exe
      Filesize

      753KB

      MD5

      bc28740fdf1b42f163cf53b135444977

      SHA1

      408bae102156552339e344510d4437be8c64b2be

      SHA256

      a70b7ebae710f650caf175ef440740b4a72a995bfba86ef355ce0d3aa33e7537

      SHA512

      fadab7b877d358e8b9334a06f2a8ceb24b710d52bf8196d35ea8bc50aab7649cd86a84ad226fcaa156f902dbe4650177e2387ecb8b4478ab5398683a389d6aea

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\240599046.exe
      Filesize

      104KB

      MD5

      7008af4d6c8a792cc119540ed6591c07

      SHA1

      744e314b4ad2f840b863fe27e3d0f50dcbb48440

      SHA256

      f05410be61773c8019254c58a2932d47da169ad47887fe14cc26a43b55399f17

      SHA512

      f131a14e56e24ceb3a1960bf752f488d98d4e9d64b8d391eb5d9a1547c91a7b75abe80a4dfeeed7c89ae8e142e6af401abcc469bbcde7321029c214b6795ea72

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\240599687.bat
      Filesize

      94B

      MD5

      3880eeb1c736d853eb13b44898b718ab

      SHA1

      4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

      SHA256

      936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

      SHA512

      3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

      Download Submit
    • memory/1340-133-0x0000000000400000-0x00000000004D7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/1340-136-0x0000000000400000-0x00000000004D7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/1340-137-0x0000000000400000-0x00000000004D7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/1340-138-0x0000000000400000-0x00000000004D7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/1340-139-0x0000000000400000-0x00000000004D7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/1340-160-0x0000000000400000-0x00000000004D7000-memory.dmp
      Filesize

      860KB

      Download
    • memory/1748-134-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

      Download