Analysis
-
max time kernel
219s -
max time network
240s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-12-2023 21:32
General
-
Target
3d9efe3771da1758923687a2b2b43b77.exe
-
Size
160KB
-
MD5
3d9efe3771da1758923687a2b2b43b77
-
SHA1
1b046f2aa79c84d02abd381a05e7dda29a962bb6
-
SHA256
11995b124e61f9fd56609b1cc9b20b6f3be1da7238f51e042e0651096f1b6101
-
SHA512
647ae6dd0a83ee496e9a9080c18332747483296d089faa533c1fc8ae1f888e7ad67e2cf2076ef61ff7b22a44f0f679bdcc60453e4b930fdb9989eddd42bd688b
-
SSDEEP
1536:6+rGkJgPDvdgSIyTZrMGoUd3eiKW7BBO+5QILr3tcABzuBu7UIBdiqHFK7L:nJcDhTZbvKWe+xLh7bqGKv
Malware Config
Extracted
pony
http://38.111.240.3:8080/pony/gate.php
http://72.37.220.10:8080/pony/gate.php
-
payload_url
http://rxgenericdropshipping.com/4Jd.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d9efe3771da1758923687a2b2b43b77.exe"C:\Users\Admin\AppData\Local\Temp\3d9efe3771da1758923687a2b2b43b77.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
200KB
-
Filesize
92KB
-
Filesize
92KB