Analysis

  • max time kernel
    110s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 23:48

General

  • Target

    3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe

  • Size

    101KB

  • MD5

    e62017ce9fed31282f565d3526573b70

  • SHA1

    047753c83932d7d3e13d2d2bf372f8ea8ec76f99

  • SHA256

    3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cd

  • SHA512

    d13442201f4ec6df33610fa7ff6df9f12c208d8fe4f5e6d9ba8e85372f55cd1390acb23df16dd3c659d8e90067f19762717478af157552bc14254970cfd1d2b7

  • SSDEEP

    1536:QhKa8Itjn6A8wcrMEqbLukrBndBWGFTewMztRtf8ki1aUcsLV2DA4a8rga3iB:8x381C9dUGVLMztZi1rV2bDsaA

Malware Config

Extracted

Family

pony

C2

http://115.47.49.181/xSZ64Wiax/ojXVZBxRQVfp6gAUziCGnB8V7Aikbs0Z.php

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe
    "C:\Users\Admin\AppData\Local\Temp\3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe"
    1⤵
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • outlook_win_path
    PID:2428

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • 115.47.49.181:80
    3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe
    260 B
    5
  • 115.47.49.181:80
    3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe
    260 B
    5
  • 115.47.49.181:80
    3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe
    260 B
    5
  • 115.47.49.181:80
    3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe
    260 B
    5
  • 115.47.49.181:80
    3493e9b0523f36f4284b3c9ea490af087c8d590d7d002dc3e5cbc50b943f72cdN.exe
    208 B
    4
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    14.160.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2428-0-0x00000000005A0000-0x00000000005AD000-memory.dmp

    Filesize

    52KB

  • memory/2428-1-0x00000000006C0000-0x00000000006CD000-memory.dmp

    Filesize

    52KB

  • memory/2428-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2428-3-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2428-4-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.