pony | 0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00

General

Target

0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Size

1.1MB
MD5

4e5556b10c33c8bcd2a381880926a29a
SHA1

c902a31d3ab532a1a1fcbb8b51a8516a9703a6ef
SHA256

0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00
SHA512

68dba86c21dc76b5a0dc483ec14dcb2ed75eac63713be72704f1c1992cf8b0732f6f838bfd8abc6e7de536a6bb626443bc4b54982ea10b80145f134e94a38f00

Score

10^/10

spyware discovery rat stealer pony

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3960 PING.EXE

pid	process
3960	PING.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.execmd.exe

description	pid	process	target process
PID 3820 wrote to memory of 3236	3820	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
PID 3820 wrote to memory of 3236	3820	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
PID 3820 wrote to memory of 3236	3820	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
PID 3236 wrote to memory of 3868	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe	cmd.exe
PID 3236 wrote to memory of 3868	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe	cmd.exe
PID 3868 wrote to memory of 3960	3868	cmd.exe	PING.EXE
PID 3868 wrote to memory of 3960	3868	cmd.exe	PING.EXE

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe

description	pid	process
Token: SeImpersonatePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeTcbPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeChangeNotifyPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeCreateTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeBackupPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeRestorePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeIncreaseQuotaPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeAssignPrimaryTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeImpersonatePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeTcbPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeChangeNotifyPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeCreateTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeBackupPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeRestorePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeIncreaseQuotaPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeAssignPrimaryTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeImpersonatePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeTcbPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeChangeNotifyPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeCreateTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeBackupPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeRestorePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeIncreaseQuotaPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeAssignPrimaryTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeImpersonatePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeTcbPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeChangeNotifyPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeCreateTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeBackupPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeRestorePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeIncreaseQuotaPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeAssignPrimaryTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeImpersonatePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeTcbPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeChangeNotifyPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeCreateTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeBackupPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeRestorePrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeIncreaseQuotaPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Token: SeAssignPrimaryTokenPrivilege	3236	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe

Checks for installed software on the system 1 TTPs 7 IoCs

discovery

Query Registry

T1012

Processes:

0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe

Script User-Agent 2 IoCs

Processes:

description flow ioc

HTTP User-Agent header 3 WinHttp.WinHttpRequest.5.1
HTTP User-Agent header 4 WinHttp.WinHttpRequest.5.1

description	flow	ioc
HTTP User-Agent header	3	WinHttp.WinHttpRequest.5.1
HTTP User-Agent header	4	WinHttp.WinHttpRequest.5.1

C:\Users\Admin\AppData\Local\Temp\0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
"C:\Users\Admin\AppData\Local\Temp\0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3820

C:\Users\Admin\AppData\Local\Temp\0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe
C:\Users\Admin\AppData\Local\Temp\0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe dfsr
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Checks for installed software on the system
PID:3236

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\Admin\AppData\Local\Temp\0450362396084be91d1e47155b5af737c50d349315689bc538f09c1ef0593b00.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\system32\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:3960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3236-0-0x0000000000000000-mapping.dmp

Download
memory/3236-1-0x0000000003010000-0x000000000302C000-memory.dmp

Filesize
112KB

Download
memory/3868-3-0x0000000000000000-mapping.dmp

Download
memory/3960-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads