Analysis
-
max time kernel
115s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-09-2024 04:00
General
-
Target
203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe
-
Size
291KB
-
MD5
e1c3629119f5302d063ffdc6b12ea3b0
-
SHA1
f00fcee9d817012bd14477dc4ca1168a8768e4a2
-
SHA256
203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983
-
SHA512
a9973c250c8d0f58d66e490f0849ff521dbb8deb910999d136d12b59b1d55d7f13ecb8cba27229d3cede1cf9a92666026eef9d88d8c1c62f9455640eb5b66631
-
SSDEEP
6144:TTDGSslfdUY26SmrEsNU8BsR3E5BOiUgUAUaBvS9ltGrnRgCm:JsyUEYBscB13UAOenGl
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe"C:\Users\Admin\AppData\Local\Temp\203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe000001D0*2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
- Loads dropped DLL
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5d3bd9c7e7a29daa24c66dc62cd5f5633
SHA13895247052b6244659e73334e6398677dafa0ac1
SHA2566b87925d0e03ab5daa4760b1a62bed66c49cb489d011e2c9633eb0fe466df83f
SHA512e243a2272887b02417b08b0d0728689c8f01cc57d473ed811ba98c2f5aa4d985d02d0fd7772bc33356474abcc815609ab7a6c0e905d6fe884fb7bc70bc67e9d0
-
Filesize
2KB
MD5d3a3043dbd27a1ecccb88347d5947cdc
SHA1f73fa833578b5c1b595595fcff765c14a5ffd765
SHA256e1694aa3ccf4f25f7d2c0b9c5ed7610621f694df0f0b4bd63c1a3245336cfad8
SHA512c7dd612a5c5bc6c527109bf59377a2da8f56e8c6dfc279c24b8e1d6a7a6763bf183372b59e8cd6481cc7a24c5f9f3b12f0b10c7b5c9c53946975083f14ed0739
-
Filesize
4KB
MD5ff7d5ec20bf73c02317e7a740fffe018
SHA1365ac8cfe5b939854cc1c341caf051bcc45f9372
SHA2561e230847d7034f5ab3bf010f569315e00673859af0574fc9f915636ed905779a
SHA51230854c0d703fd7c6cbc0769d9be4125baa2577ec529d5e48177a434685b66752fd79c50f0321324e23eeb985738f403347748afefae7d8a3bfad388a5b512a44
-
Filesize
5KB
MD53e7a118b119428247edfc5d5ef3761bc
SHA1140e4cb00107678160411f016c4c17611580a209
SHA25697c19f4103a16798202e50a501375d0bf3d7ec1bb654dda230337e85b01b1ec5
SHA512b0e27a4d7aa62f937f275b9f413f75857846ae670bf3aed6e55c1db865485fda89e33dcdffa02ae2ab25f48d5f63f869232f9e6d69f9cdc8a5c93f39de09a925
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
306KB
-
Filesize
88KB
-
Filesize
140KB
-
Filesize
306KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
88KB