pony | f515d67b069dfb177559d773b872dfeacadbfbdb4dde4a7903357b6dc181087f

General

Target

ECF21D23BC761CD82181A9C50C8E7323.exe
Size

1.4MB
MD5

ecf21d23bc761cd82181a9c50c8e7323
SHA1

4175dd599ca9dce7a9c4d2c7bcfdf4738164a162
SHA256

f515d67b069dfb177559d773b872dfeacadbfbdb4dde4a7903357b6dc181087f
SHA512

8843675a5354b74c18863c17053f64fef1c5d62cd0a6c84bf493bc50756dd389be45895de6c4a6ff5ea079ba22a1477bc1924a31928733f8797240e5ae779966

Score

10^/10

pony persistence rat spyware stealer

Malware Config

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Executes dropped EXE 2 IoCs

Processes:

HVNUhLUUhc.exeWYCT.exe

pid process

904 HVNUhLUUhc.exe
2732 WYCT.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ECF21D23BC761CD82181A9C50C8E7323.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ECF21D23BC761CD82181A9C50C8E7323.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ECF21D23BC761CD82181A9C50C8E7323.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

WYCT.exe

description pid process target process

PID 2732 set thread context of 2864 2732 WYCT.exe RegSvcs.exe

description	pid	process	target process
PID 2732 set thread context of 2864	2732	WYCT.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

HVNUhLUUhc.exeWYCT.exe

pid	process
904	HVNUhLUUhc.exe
904	HVNUhLUUhc.exe
904	HVNUhLUUhc.exe
904	HVNUhLUUhc.exe
904	HVNUhLUUhc.exe
904	HVNUhLUUhc.exe
904	HVNUhLUUhc.exe
904	HVNUhLUUhc.exe
2732	WYCT.exe
2732	WYCT.exe
2732	WYCT.exe
2732	WYCT.exe
2732	WYCT.exe
2732	WYCT.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

RegSvcs.exe

description	pid	process
Token: SeImpersonatePrivilege	2864	RegSvcs.exe
Token: SeTcbPrivilege	2864	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2864	RegSvcs.exe
Token: SeCreateTokenPrivilege	2864	RegSvcs.exe
Token: SeBackupPrivilege	2864	RegSvcs.exe
Token: SeRestorePrivilege	2864	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2864	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2864	RegSvcs.exe
Token: SeImpersonatePrivilege	2864	RegSvcs.exe
Token: SeTcbPrivilege	2864	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2864	RegSvcs.exe
Token: SeCreateTokenPrivilege	2864	RegSvcs.exe
Token: SeBackupPrivilege	2864	RegSvcs.exe
Token: SeRestorePrivilege	2864	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2864	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2864	RegSvcs.exe
Token: SeImpersonatePrivilege	2864	RegSvcs.exe
Token: SeTcbPrivilege	2864	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2864	RegSvcs.exe
Token: SeCreateTokenPrivilege	2864	RegSvcs.exe
Token: SeBackupPrivilege	2864	RegSvcs.exe
Token: SeRestorePrivilege	2864	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2864	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2864	RegSvcs.exe
Token: SeImpersonatePrivilege	2864	RegSvcs.exe
Token: SeTcbPrivilege	2864	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2864	RegSvcs.exe
Token: SeCreateTokenPrivilege	2864	RegSvcs.exe
Token: SeBackupPrivilege	2864	RegSvcs.exe
Token: SeRestorePrivilege	2864	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2864	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2864	RegSvcs.exe
Token: SeImpersonatePrivilege	2864	RegSvcs.exe
Token: SeTcbPrivilege	2864	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2864	RegSvcs.exe
Token: SeCreateTokenPrivilege	2864	RegSvcs.exe
Token: SeBackupPrivilege	2864	RegSvcs.exe
Token: SeRestorePrivilege	2864	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2864	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2864	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ECF21D23BC761CD82181A9C50C8E7323.exeHVNUhLUUhc.exeWYCT.exeRegSvcs.exe

description	pid	process	target process
PID 3016 wrote to memory of 904	3016	ECF21D23BC761CD82181A9C50C8E7323.exe	HVNUhLUUhc.exe
PID 3016 wrote to memory of 904	3016	ECF21D23BC761CD82181A9C50C8E7323.exe	HVNUhLUUhc.exe
PID 3016 wrote to memory of 904	3016	ECF21D23BC761CD82181A9C50C8E7323.exe	HVNUhLUUhc.exe
PID 904 wrote to memory of 2732	904	HVNUhLUUhc.exe	WYCT.exe
PID 904 wrote to memory of 2732	904	HVNUhLUUhc.exe	WYCT.exe
PID 904 wrote to memory of 2732	904	HVNUhLUUhc.exe	WYCT.exe
PID 2732 wrote to memory of 2864	2732	WYCT.exe	RegSvcs.exe
PID 2732 wrote to memory of 2864	2732	WYCT.exe	RegSvcs.exe
PID 2732 wrote to memory of 2864	2732	WYCT.exe	RegSvcs.exe
PID 2732 wrote to memory of 2864	2732	WYCT.exe	RegSvcs.exe
PID 2732 wrote to memory of 2864	2732	WYCT.exe	RegSvcs.exe
PID 2864 wrote to memory of 196	2864	RegSvcs.exe	cmd.exe
PID 2864 wrote to memory of 196	2864	RegSvcs.exe	cmd.exe
PID 2864 wrote to memory of 196	2864	RegSvcs.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ECF21D23BC761CD82181A9C50C8E7323.exe
"C:\Users\Admin\AppData\Local\Temp\ECF21D23BC761CD82181A9C50C8E7323.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HVNUhLUUhc.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HVNUhLUUhc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Roaming\WYCT.exe
"C:\Users\Admin\AppData\Roaming\WYCT.exe" "C:\Users\Admin\AppData\Roaming\QDTac"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259272812.bat" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" "
5⤵
PID:196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259272812.bat
MD5
3880eeb1c736d853eb13b44898b718ab

SHA1
4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

SHA256
936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

SHA512
3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HVNUhLUUhc.exe
MD5
a59141b12cc64d52f4785f6007abbf66

SHA1
9f0509932a0cfd50d5c38007361ddfc9bab8c5bf

SHA256
663d9a51b07dd14b63261ac7049b885f6371bb46aa5f71a9501eeafad6f14016

SHA512
cf44342dce70fb41b57aa1bb6da58af4463689af43fb9f83851ff95feeb152f500c3afa90d7f9db4f9cea2d8a54e9f1928df7380d3dd55f835ba340b7caa4f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HVNUhLUUhc.exe
MD5
a59141b12cc64d52f4785f6007abbf66

SHA1
9f0509932a0cfd50d5c38007361ddfc9bab8c5bf

SHA256
663d9a51b07dd14b63261ac7049b885f6371bb46aa5f71a9501eeafad6f14016

SHA512
cf44342dce70fb41b57aa1bb6da58af4463689af43fb9f83851ff95feeb152f500c3afa90d7f9db4f9cea2d8a54e9f1928df7380d3dd55f835ba340b7caa4f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QDTac
MD5
55af7b04f7c77d2d99b234c17bfe5296

SHA1
af2aaf8c925893c872299248958688212fbf24bd

SHA256
f23e23c993dd86101e730884c03e3e0ae62b866f35087146e8738ca7eef2b5b9

SHA512
5cd2473fe69c5f819651f3a358caccc680cd6344453eb296dd5117473badf07778714f301b389041ea98eb44ec737706636418d5b5e1e09abdfb4a2d3777373b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WYCT.exe
MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
C:\Users\Admin\AppData\Roaming\QDTac
MD5
5fb74b11b33a01483d297c3440f5d8a4

SHA1
2470d19cdf9fb759a2a616cb111b9528a0f0ed8b

SHA256
c7011f9efc1b48badca16733ba041e92c31e35e246ebb16cd17ac1ee6838b620

SHA512
030216026bcd7af34d899d48e81928eba9bb6da5e8539d24233a6eadc92be6b9a9cdd6c20c990622dd96ab1ceb25b6381c61b3dd30518bdeb37f3301cfae2bbe

Download Submit
C:\Users\Admin\AppData\Roaming\WYCT.exe
MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
memory/196-127-0x0000000000000000-mapping.dmp

Download
memory/904-116-0x0000000000000000-mapping.dmp

Download
memory/2732-119-0x0000000000000000-mapping.dmp

Download
memory/2864-126-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2864-125-0x0000000000410621-mapping.dmp

Download
memory/2864-124-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads