pony | dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75

Target

dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Size

579KB
MD5

b7b86225defaae424aa2e447fc784088
SHA1

4cb5d0afea368c7668fda827d5c8a0fea122520a
SHA256

dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75
SHA512

aedb708457385bcb8f6e5aed625d1926f276afb1d0b57c276d56a4c05c8dd3e207d17767d2d8887c795c688d87b773d281c520278a5eeccc2eb83d13f5dbfd5b

Score

10^/10

pony collection discovery rat spyware stealer suricata

Malware Config

Extracted

Family

pony

http://timetoeatout.com/forum/viewtopic.php

http://mypersonalpathtopregnancy.com/forum/viewtopic.php

http://webersmokeymountaincookerreview.com/forum/viewtopic.php

http://wiiunlockplusreview.com/forum/viewtopic.php

Attributes

payload_url
http://www.sheltiezuchtverein-deutschland-ev.de/bn43.exe

http://ciclografico.pt/9Up.exe

http://simplesites.gr/vr75i.exe

http://mdebra.o2switch.net/2ccVsM9z.exe

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

description	pid	process
Token: SeImpersonatePrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Token: SeTcbPrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Token: SeChangeNotifyPrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Token: SeCreateTokenPrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Token: SeBackupPrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Token: SeRestorePrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Token: SeIncreaseQuotaPrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
Token: SeAssignPrimaryTokenPrivilege	3656	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

outlook_win_path 1 IoCs

Processes:

dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe

C:\Users\Admin\AppData\Local\Temp\dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe
"C:\Users\Admin\AppData\Local\Temp\dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75.exe"
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:3656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3656-130-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3656-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3656-131-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3656-133-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download