Overview

overview

10

Static

static

3

de8e57ce36...34.exe

windows7-x64

10

de8e57ce36...34.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2024 17:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de8e57ce36c3b6d7a08e9d8291d64f34.exe

  • Size

    274KB

  • MD5

    de8e57ce36c3b6d7a08e9d8291d64f34

  • SHA1

    eb9dc8c686c18c4d88bcbc74805cf73a4f760122

  • SHA256

    c069224235b4f48f9835b50a00d791a0d2e98a34c2073b60a51aea2e1c9bfbd2

  • SHA512

    59df4e64cf95770a4e64990f8346c9f9376fcfd31d2c8c3bca315683c70959b1a5f4c0f8d7e4a3d389e87bf384133c83b7c0b2ba68838bea9ba33fa572cd74ed

  • SSDEEP

    6144:5dZ8oLDWKzjZcYrieLvzbNqWf2WeNR51WHhDxw2Qvgx4:7LpzjeWLfmRHMhDxw2n

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\de8e57ce36c3b6d7a08e9d8291d64f34.exe
    "C:\Users\Admin\AppData\Local\Temp\de8e57ce36c3b6d7a08e9d8291d64f34.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2892
    • C:\Users\Admin\AppData\Local\Temp\de8e57ce36c3b6d7a08e9d8291d64f34.exe
      C:\Users\Admin\AppData\Local\Temp\de8e57ce36c3b6d7a08e9d8291d64f34.exe startC:\Users\Admin\AppData\Roaming\3A7AC\DD87F.exe%C:\Users\Admin\AppData\Roaming\3A7AC
      2⤵
        PID:2052
      • C:\Users\Admin\AppData\Local\Temp\de8e57ce36c3b6d7a08e9d8291d64f34.exe
        C:\Users\Admin\AppData\Local\Temp\de8e57ce36c3b6d7a08e9d8291d64f34.exe startC:\Program Files (x86)\ACE36\lvvm.exe%C:\Program Files (x86)\ACE36
        2⤵
          PID:1192
        • C:\Program Files (x86)\LP\7F43\A2F3.tmp
          "C:\Program Files (x86)\LP\7F43\A2F3.tmp"
          2⤵
          • Executes dropped EXE
          PID:1516
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2668
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1404

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Privilege Escalation

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Defense Evasion

      Modify Registry

      4
      T1112

      Credential Access

      Unsecured Credentials

      2
      T1552

      Credentials In Files

      2
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\3A7AC\CE36.A7A
        Filesize

        297B

        MD5

        f35de969e48aeafe599485c0bb8a77f8

        SHA1

        a13e667d2f138998fd8d84cd3b38584dfbe0f679

        SHA256

        0e022b233d7359815c17c203beb3395c10e7332f5d47ccc50b239a8df8da7390

        SHA512

        429d040fa55156fd62072d7d3c33b2126f2532e37e31502033206488a78a73ed6994f847791b8896f9d1d3a48d717d0ab3ec469c081bacac588e7c3dea93b044

        Download Submit
      • C:\Users\Admin\AppData\Roaming\3A7AC\CE36.A7A
        Filesize

        1KB

        MD5

        95d3eac5a06414fb218182ec76c31385

        SHA1

        f096a8fba7a6773865c42eb6a77906420723430c

        SHA256

        eae0315b56b075558e88e1dd20ddccc45515548ede3b52c025ee395b1a09347f

        SHA512

        2e0d8bc09435218a3d4ce271d9341100d9d56f3ba899db25726beeebfd3d59c52a028a6c8b138cdef1b20a3d33fe1c25ed7801715812110896c775f5cfcdf5ae

        Download Submit
      • C:\Users\Admin\AppData\Roaming\3A7AC\CE36.A7A
        Filesize

        1KB

        MD5

        b407ae31188c6fc7afe1aa056d539aea

        SHA1

        44b01a671b35b346ca35d5f742d62b775e0218c7

        SHA256

        f32451e0ccd350d738ae57af3bc7e824edc8d31945402e790672e6d5a1055ac2

        SHA512

        8664740638546587ea689baa81218ea9089f2b9c68ec88e89240f428ed280b16d06ada69b1c18472768163bce4af089d8b3718415babc69d14ea78761d11d2e1

        Download Submit
      • C:\Users\Admin\AppData\Roaming\3A7AC\CE36.A7A
        Filesize

        2KB

        MD5

        4d7c6ed00ab6ebebb35d8010af41de84

        SHA1

        777f8c990d2d444473b9c433bb4a5d22455f5344

        SHA256

        656416f8aeacb8604822a6c09068b09a27d9e3134acba9ec3234afc67ddb1c74

        SHA512

        c59ab0043bca431426e03afe05f45a572dbc6a53a04db6ee5fa79c2f3b90938f77e3cbc22589bec2836711a24e079290759f5774ea1412a02fe2d74b1b206c83

        Download Submit
      • C:\Users\Admin\AppData\Roaming\3A7AC\CE36.A7A
        Filesize

        897B

        MD5

        81d48bb770fdaf7cb245ac1dec2a2eb4

        SHA1

        1e2a8b61c203f45e084ef3fbd1a2b6698c8cc1eb

        SHA256

        f78bf975423546d76e28aa66fe7b8d122d98d72e6a99814b404f68137a5374bf

        SHA512

        cfc86a827ed41c719e57e770e48713fa1f36e0b2432aaf0508b5802f13d40769cfff997b89cc031166f26926456f3d45af472464e74595aba5d3f5a87f80af68

        Download Submit
      • \Program Files (x86)\LP\7F43\A2F3.tmp
        Filesize

        96KB

        MD5

        cad2c820b73a6442ef964123f5c9c4f6

        SHA1

        7a10cae630948eb0700d8b2b06b3468164b5d1d4

        SHA256

        5a15cf2c4f52cc40004187ed98441fd921823b43f1eb1fcc36954635936df7f0

        SHA512

        4d0e07556f5008543edba456647239f51087b5e4ad3895d12b0ae8d73247665f336a26ba4560a337a0e701d67e86a7ac1eb8dad5f6e660ac8ec402eefd43ab05

        Download Submit
      • memory/1192-235-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/1192-236-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/1192-237-0x0000000000646000-0x0000000000669000-memory.dmp
        Filesize

        140KB

        Download
      • memory/1404-354-0x0000000004130000-0x0000000004131000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1404-232-0x0000000004130000-0x0000000004131000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1516-254-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/1516-352-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/1516-255-0x00000000002D0000-0x00000000003D0000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/2052-79-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/2052-80-0x0000000000576000-0x0000000000599000-memory.dmp
        Filesize

        140KB

        Download
      • memory/2892-77-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/2892-0-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/2892-3-0x0000000000290000-0x0000000000390000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/2892-2-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/2892-351-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/2892-233-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/2892-127-0x0000000000290000-0x0000000000390000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/2892-357-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download