Analysis
-
max time kernel
255s -
max time network
299s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 02:37
General
-
Target
4d1ada6a834c4a558497d926514671c7.exe
-
Size
144KB
-
MD5
4d1ada6a834c4a558497d926514671c7
-
SHA1
c09a794c29bbe2d584cc5d81224ecb979170b65e
-
SHA256
0fc1acc36e907751bdc37967ed5912ff3319575a32c5946c313fe1e880bbdf4a
-
SHA512
b477e7ef7d15fa0bd14b5eb71336b9e79620d3ed6810d38f834b1e1302c335d5dc804b49220ffd0eef4d5f1b4bd00e211cede8af259f040a002291c02423d57c
-
SSDEEP
1536:Re6wTEDBNFxUhGKc7iaBxOR2mAShTopW8b/87G2PXhBp7uRdEGtbJN3OQX1R50O8:RRPUtirxOkmr9op3UJfh/SAW1N3mOxG
Malware Config
Extracted
pony
http://98.158.129.17:8080/pony/gate.php
http://69.194.194.90/pony/gate.php
-
payload_url
http://acessolojavirtual.com.br/evE.exe
http://dadibra.com/McbJd.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d1ada6a834c4a558497d926514671c7.exe"C:\Users\Admin\AppData\Local\Temp\4d1ada6a834c4a558497d926514671c7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
156KB
-
Filesize
92KB