Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28-12-2023 03:21

General

  • Target

    bf81ecf7e62d56f044f48b41e7b4be3c.exe

  • Size

    132KB

  • MD5

    bf81ecf7e62d56f044f48b41e7b4be3c

  • SHA1

    fd42b423dcecc1373e3647f3d2f5386405a3cc09

  • SHA256

    44cb7922931fb4c9c1ee124862e2cadd2a20b59425123991011fa6829cffb53c

  • SHA512

    762517b275cded287447ae569d34b5490a691360e3613c5cdb917bd2c2996293db7bc380a369b37e9247f7bf88ea49579dee2aaf8ae7de30160fa5001023ff39

  • SSDEEP

    1536:DfbmUgeUtHmOC6MLcuLpOk+fCdqLaVzRANwRziQa6Z3knH/P3JVgRYEIkht8gVD4:DfbmUkNmOJML3gl8ia4wvzCVkfVrMeP

Score
10/10

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://209.59.219.70/forum/viewtopic.php

Attributes
  • payload_url

    http://birdofparadisepub.com/poQYPP.exe

    http://15dimensionsofhealing.com/Qei73he.exe

    http://petradumpe.com/UYoG.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe
    "C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe
      "C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe"
      2⤵
        PID:2512

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2044-0-0x0000000000370000-0x0000000000395000-memory.dmp

      Filesize

      148KB

    • memory/2044-2-0x0000000000180000-0x00000000001A5000-memory.dmp

      Filesize

      148KB

    • memory/2044-1-0x0000000000370000-0x0000000000395000-memory.dmp

      Filesize

      148KB