Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
29/12/2023, 21:33
General
-
Target
048a376938c0164b473fa9705f4c6ac1.exe
-
Size
178KB
-
MD5
048a376938c0164b473fa9705f4c6ac1
-
SHA1
8f3b67bbb8eabf0a6f56a96aecde3de02de9cd20
-
SHA256
732573ac5d7b203b29b93c279b4b4b19b5098c2557fc42758c1b10af0711582b
-
SHA512
ed94573e1ec9c3c8a7563caee4801c73aefe3c4e0dffb31c4e24c8bdc51c9efbe8754bf72da86687bebdfa2a8b272a53f7f5aa21184105b99b70b1a859363744
-
SSDEEP
3072:UN/qvxMEy+ySG1GneljQDcI04v0QhCXUAwn+sP:aSxMEy+ySG1GneyDc14sEJn+k
Malware Config
Extracted
pony
http://222.255.28.16:8080/pony/gate.php
http://88.119.29.2:8080/pony/gate.php
-
payload_url
http://ottolife.com.br/7qyLRunm/HQHUG2V.exe
http://comehomeonline.com/eXTo438J/btVSV.exe
http://tmaurice.com/Ud2agJws/dQfu.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\048a376938c0164b473fa9705f4c6ac1.exe"C:\Users\Admin\AppData\Local\Temp\048a376938c0164b473fa9705f4c6ac1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
192KB
-
Filesize
92KB
-
Filesize
92KB