Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 02:41
General
-
Target
82b3c8f1a3eeefee3185c473cb9cae2b5751643f8620b8f942ebd147f99e202eN.exe
-
Size
97KB
-
MD5
e8dc51fc01f70870a1462cc1ab45be40
-
SHA1
e5ba6e7795d4698d75445f17b9205bd9095a1d98
-
SHA256
82b3c8f1a3eeefee3185c473cb9cae2b5751643f8620b8f942ebd147f99e202e
-
SHA512
1186864c8c592960b90dbda4481d0ad37e175ccb9b41b031c682a058bc70faf365a4711b0b545f9c8d3f529dc5ee9c61cf5730990a2a25d1c87a9284490be7b8
-
SSDEEP
1536:Q0okmAT0g4LttL7Q0iu8P6zCpZS5WngmFKenenYecr7d/+QBLAr16224XKfI3d:lw/Q0iuk6O6MUene6Pd5LV2Iud
Malware Config
Extracted
pony
http://91.206.143.137:8080/pony/gate.php
http://50.57.121.196:8080/pony/gate.php
-
payload_url
http://www.coriandrum.com/4a1jgYXB.exe
http://emediawebservices.com/bEP9.exe
http://www.ozelgazihastanesi.com/puT.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82b3c8f1a3eeefee3185c473cb9cae2b5751643f8620b8f942ebd147f99e202eN.exe"C:\Users\Admin\AppData\Local\Temp\82b3c8f1a3eeefee3185c473cb9cae2b5751643f8620b8f942ebd147f99e202eN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
112KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
112KB
-
Filesize
92KB