Analysis
-
max time kernel
1s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
07-01-2024 19:41
General
-
Target
ab3f220096dd4a0e1ada544fdf7e7a44.exe
-
Size
194KB
-
MD5
ab3f220096dd4a0e1ada544fdf7e7a44
-
SHA1
864f43653a725082948b33b509c09d62d1bec601
-
SHA256
06377b3a3c7619c10c31dd82534334e0decb9365958464a1006044a845db4068
-
SHA512
934365af6198dfc05cde76be7bc3f45ed7361024f6065d47c19e73c7d7a2bcc6108e216bc8582b64718a63b27ba51cb8977dfcf094bfc01a4fc8755244d5b255
-
SSDEEP
3072:640aHK/kfGcOgPtdUYxUD0u+LCVaiR9Fpuh:70mVIKLiao6
Malware Config
Extracted
pony
http://momus.com.tw:8080/pony/gate.php
http://66.175.216.69/pony/gate.php
-
payload_url
http://www.dihal.com.br/aB64Vw6G/L6f.exe
http://rosariodanza.com/CpTXByXo/qGzt2gTT.exe
http://alicianovias.com.ar/Pw0g76UB/kjjEmJ.exe
http://ssquarehospitality.com/to04gp5h/ewR7.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab3f220096dd4a0e1ada544fdf7e7a44.exe"C:\Users\Admin\AppData\Local\Temp\ab3f220096dd4a0e1ada544fdf7e7a44.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
216KB
-
Filesize
100KB