Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-02-2024 18:37
General
-
Target
ac92a1c6f54dfecaa5da8bcc61944421.exe
-
Size
97KB
-
MD5
ac92a1c6f54dfecaa5da8bcc61944421
-
SHA1
69cdad2f244f13f60d4eefa37d629a411fcd8a28
-
SHA256
2a435df53140cc533f0ae64c6e4d08e850099e19e49278bbffbe3a5c86aaf460
-
SHA512
6f664830be592aa1eb79b54dae2d38f180b830350bb1f7fd0604a71b55d34a62ed0816fcc25fefd4c223988070a26ec5b2ff985bd21f2bbfcf9e7311ee1e3509
-
SSDEEP
1536:IhWUBVeeGAOrcuWvsTnGM278e/UBL8xmEfa+XZBVubzpyJrnenYeOyaLURdxyCtb:+jvNjMO1/UBLumszPHlneYyKUVF1cy
Malware Config
Extracted
pony
http://176.31.255.41:8080/pony/gate.php
http://91.206.143.137:8080/pony/gate.php
-
payload_url
http://www.sursoftware.com.ar/WCwDHMYw.exe
http://www.screenshotsarchive.com/Ku4n.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac92a1c6f54dfecaa5da8bcc61944421.exe"C:\Users\Admin\AppData\Local\Temp\ac92a1c6f54dfecaa5da8bcc61944421.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
112KB
-
Filesize
92KB
-
Filesize
112KB
-
Filesize
92KB