Analysis

  • max time kernel
    114s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 08:48

General

  • Target

    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe

  • Size

    137KB

  • MD5

    9cda552d03be8518a09e414b7b915bd0

  • SHA1

    5b70e583a2d4580650ac352022ce637a11f53f24

  • SHA256

    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1

  • SHA512

    8732a48c0a5ba2cdc3a9c63120c9484229aba2659820b5a6a813153d051d132eff0b26352cb3fed7c35c6074ecfdccd8934c83e8a095405e62f3d26d3499349e

  • SSDEEP

    3072:25SZadCWKFIj4yO2kMZicfZumhttHtZDw:OZxKC4fruYmhDDM

Malware Config

Extracted

Family

pony

C2

http://angels-mail.com:8080/ponys/gate.php

http://mail.yaklasim.com:8080/ponys/gate.php

http://lipo-exdallas.com/ponys/gate.php

http://lipo-exdenver.com/ponys/gate.php

Attributes
  • payload_url

    http://kartoteka-tbns.com.pl/5Wd11h7t.exe

    http://seniorenservice-hp.de/BGXN.exe

    http://www.woicknet.de/f33Q.exe

    http://amayuscula.com.mx/jq6mT.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    "C:\Users\Admin\AppData\Local\Temp\659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe"
    1⤵
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • outlook_win_path
    PID:1760

Network

  • flag-us
    DNS
    angels-mail.com
    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    Remote address:
    8.8.8.8:53
    Request
    angels-mail.com
    IN A
    Response
    angels-mail.com
    IN A
    66.81.203.198
    angels-mail.com
    IN A
    66.81.203.133
    angels-mail.com
    IN A
    66.81.203.8
  • 66.81.203.198:8080
    angels-mail.com
    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    152 B
    3
  • 66.81.203.198:8080
    angels-mail.com
    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    152 B
    3
  • 66.81.203.198:8080
    angels-mail.com
    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    152 B
    3
  • 66.81.203.198:8080
    angels-mail.com
    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    152 B
    3
  • 66.81.203.198:8080
    angels-mail.com
    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    104 B
    2
  • 8.8.8.8:53
    angels-mail.com
    dns
    659c126b2e5b919ff0379f5a439354a0d304d0f61784ff60dc7e7f759c2a74a1N.exe
    61 B
    109 B
    1
    1

    DNS Request

    angels-mail.com

    DNS Response

    66.81.203.198
    66.81.203.133
    66.81.203.8

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1760-0-0x0000000000404000-0x0000000000405000-memory.dmp

    Filesize

    4KB

  • memory/1760-1-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1760-3-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1760-2-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1760-4-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1760-5-0x0000000000404000-0x0000000000405000-memory.dmp

    Filesize

    4KB

  • memory/1760-6-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.