pony | 2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9

Analysis

max time kernel
94s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 22:56

Target

2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe
Size

698KB
MD5

6210461d248282d27a8aa1df51680cc0
SHA1

f2ebd2954003481d2d05a30d818cf0540d83ef85
SHA256

2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9
SHA512

b0f0cf614944b71ea27a7c732cbb95391ea4f33a7cf0a4d627d762ba1ab2b2fe843c82baf4eaa42a9b74fb6b1c1f4f1b91cfdd622d4fa352c1f4275a5a2a1f8f
SSDEEP

3072:Aa+63zUk8WkIq3ttKiCV3VFL9e1+4lErHRjhtsUTN0Psc/ZnWybM8K:4b7eUErHRFt3Ks+Zy

Score

10^/10

Family

pony

http://logmaster.net46.net/logmaster/panelnew/gate.php

Attributes

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of SetThreadContext 1 IoCs

Processes:

2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe

description	pid	process	target process
PID 1360 set thread context of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1340 5104 WerFault.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe

description pid process

Token: SeDebugPrivilege 1360 2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe

pid	pid_target	process	target process
1340	5104	WerFault.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe

description	pid	process	target process
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe
PID 1360 wrote to memory of 5104	1360	2c22c1c47874d00c21bbf12cc7554b0c6dc283d72112b59b000deec0d0c5c1f9.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 632
3⤵
- Program crash
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5104 -ip 5104
1⤵
PID:4820

memory/1360-132-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/1360-133-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/1360-145-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/5104-134-0x0000000000000000-mapping.dmp

Download
memory/5104-136-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download
memory/5104-140-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download
memory/5104-146-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download