pony | 5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34

General

Target

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe
Size

73KB
MD5

36e311a6761be1243eca468269ab86b9
SHA1

9a7a7bad88fddf475e86499390813743e81c1a0c
SHA256

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34
SHA512

0824d9865220785972410d5d9c709187011f6dd5f59111f1435c276acd7e4cb3b6c55afbad7b2a47e9e92906c56741e5d5e040f4bc35afd29772a812ff426e00
SSDEEP

1536:o4Mu3BeVrqmYdsTmaDSleuaoP4GACntaE9YLUiu7tfF:o0aMsCaDqGSAECLUi0tfF

Score

10^/10

pony collection persistence rat spyware stealer upx

Malware Config

Extracted

Family

pony

C2

http://igwe.3eeweb.com/1/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1688-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1688-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1688-60-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1688-66-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1688-67-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1688-69-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1688-71-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1688-72-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\side = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\side.exe"	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

description	pid	process	target process
PID 800 set thread context of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe
Token: SeImpersonatePrivilege	1688	svchost.exe
Token: SeTcbPrivilege	1688	svchost.exe
Token: SeChangeNotifyPrivilege	1688	svchost.exe
Token: SeCreateTokenPrivilege	1688	svchost.exe
Token: SeBackupPrivilege	1688	svchost.exe
Token: SeRestorePrivilege	1688	svchost.exe
Token: SeIncreaseQuotaPrivilege	1688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1688	svchost.exe
Token: SeImpersonatePrivilege	1688	svchost.exe
Token: SeTcbPrivilege	1688	svchost.exe
Token: SeChangeNotifyPrivilege	1688	svchost.exe
Token: SeCreateTokenPrivilege	1688	svchost.exe
Token: SeBackupPrivilege	1688	svchost.exe
Token: SeRestorePrivilege	1688	svchost.exe
Token: SeIncreaseQuotaPrivilege	1688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1688	svchost.exe
Token: SeImpersonatePrivilege	1688	svchost.exe
Token: SeTcbPrivilege	1688	svchost.exe
Token: SeChangeNotifyPrivilege	1688	svchost.exe
Token: SeCreateTokenPrivilege	1688	svchost.exe
Token: SeBackupPrivilege	1688	svchost.exe
Token: SeRestorePrivilege	1688	svchost.exe
Token: SeIncreaseQuotaPrivilege	1688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1688	svchost.exe
Token: SeImpersonatePrivilege	1688	svchost.exe
Token: SeTcbPrivilege	1688	svchost.exe
Token: SeChangeNotifyPrivilege	1688	svchost.exe
Token: SeCreateTokenPrivilege	1688	svchost.exe
Token: SeBackupPrivilege	1688	svchost.exe
Token: SeRestorePrivilege	1688	svchost.exe
Token: SeIncreaseQuotaPrivilege	1688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1688	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

description	pid	process	target process
PID 800 wrote to memory of 884	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 884	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 884	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 884	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 940	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 940	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 940	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 940	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 800 wrote to memory of 1688	800	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe

outlook_win_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe
"C:\Users\Admin\AppData\Local\Temp\5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:884
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:940
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_win_path
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

2

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\side.exe

Filesize
73KB

MD5
36e311a6761be1243eca468269ab86b9

SHA1
9a7a7bad88fddf475e86499390813743e81c1a0c

SHA256
5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34

SHA512
0824d9865220785972410d5d9c709187011f6dd5f59111f1435c276acd7e4cb3b6c55afbad7b2a47e9e92906c56741e5d5e040f4bc35afd29772a812ff426e00

Download Submit
memory/800-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/800-55-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/800-70-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/884-56-0x0000000000000000-mapping.dmp

Download
memory/940-57-0x0000000000000000-mapping.dmp

Download
memory/1688-64-0x000000000041ADF0-mapping.dmp

Download
memory/1688-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-67-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-69-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-71-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-72-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads