Overview

overview

10

Static

static

5

aaecf776a6...6c.exe

windows7-x64

10

aaecf776a6...6c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2023 10:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aaecf776a6f8850da8a1b4d63bc15e6c.exe

  • Size

    1.1MB

  • MD5

    aaecf776a6f8850da8a1b4d63bc15e6c

  • SHA1

    a17344b14cc9bf756d8b52666dfb665e19e8bb31

  • SHA256

    7c4e0b95c73cc6c75ad1c74bc4bb7ea27444015c9934a000cf183eb5d4948a3b

  • SHA512

    8f8a04540d5c3dde132dd876376dc1b0195cc911c0ca746f67a4761d5c00602c7cb1cf1958d03cbddf3736cfe46a22c7ae1ad634b5260db4c89cb3aae2950f8d

  • SSDEEP

    24576:iu6J33O0c+JY5UZ+XC0kGsoTGcjr1I1lOq6sb8hTH7NWYu:Eu0c++OCvkGsEGcjr1i6skHUYu

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://185.79.156.18/bit/03/gate.php

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaecf776a6f8850da8a1b4d63bc15e6c.exe
    "C:\Users\Admin\AppData\Local\Temp\aaecf776a6f8850da8a1b4d63bc15e6c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
        PID:2388
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
        2⤵
          PID:4036
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
          2⤵
          • Checks computer location settings
          • Accesses Microsoft Outlook accounts
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_win_path
          PID:3748
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240584546.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "
            3⤵
              PID:4780
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\aaecf776a6f8850da8a1b4d63bc15e6c.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1064
            • C:\Windows\SysWOW64\timeout.exe
              TimeOut 1
              3⤵
              • Delays execution with timeout.exe
              PID:4124

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Credentials in Files

        2
        T1081

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Email Collection

        2
        T1114

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\240584546.bat
          Filesize

          94B

          MD5

          3880eeb1c736d853eb13b44898b718ab

          SHA1

          4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

          SHA256

          936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

          SHA512

          3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

          Download Submit
        • memory/1632-133-0x0000000000090000-0x00000000001B8000-memory.dmp
          Filesize

          1.2MB

          Download
        • memory/1632-144-0x00000000011E0000-0x00000000011E1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3748-136-0x0000000000400000-0x0000000000419000-memory.dmp
          Filesize

          100KB

          Download
        • memory/3748-142-0x0000000000400000-0x0000000000419000-memory.dmp
          Filesize

          100KB

          Download