pony | 5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34

General

Target

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe
Size

73KB
MD5

36e311a6761be1243eca468269ab86b9
SHA1

9a7a7bad88fddf475e86499390813743e81c1a0c
SHA256

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34
SHA512

0824d9865220785972410d5d9c709187011f6dd5f59111f1435c276acd7e4cb3b6c55afbad7b2a47e9e92906c56741e5d5e040f4bc35afd29772a812ff426e00
SSDEEP

1536:o4Mu3BeVrqmYdsTmaDSleuaoP4GACntaE9YLUiu7tfF:o0aMsCaDqGSAECLUi0tfF

Score

10^/10

pony persistence rat spyware stealer upx

Malware Config

Extracted

Family

pony

C2

http://igwe.3eeweb.com/1/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2364-137-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2364-139-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2364-140-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2364-141-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\side = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\side.exe"	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

description	pid	process	target process
PID 3768 set thread context of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe
Token: SeImpersonatePrivilege	2364	svchost.exe
Token: SeTcbPrivilege	2364	svchost.exe
Token: SeChangeNotifyPrivilege	2364	svchost.exe
Token: SeCreateTokenPrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe

description	pid	process	target process
PID 3768 wrote to memory of 1416	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 3768 wrote to memory of 1416	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 3768 wrote to memory of 1416	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 3768 wrote to memory of 4984	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 3768 wrote to memory of 4984	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 3768 wrote to memory of 4984	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	CMD.exe
PID 3768 wrote to memory of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 3768 wrote to memory of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 3768 wrote to memory of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 3768 wrote to memory of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 3768 wrote to memory of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 3768 wrote to memory of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe
PID 3768 wrote to memory of 2364	3768	5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe
"C:\Users\Admin\AppData\Local\Temp\5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:4984
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\side.exe

Filesize
73KB

MD5
36e311a6761be1243eca468269ab86b9

SHA1
9a7a7bad88fddf475e86499390813743e81c1a0c

SHA256
5ab3d7560b20dfcea8ebd7b852fcccb04c2967b77b87802d691d919d71664d34

SHA512
0824d9865220785972410d5d9c709187011f6dd5f59111f1435c276acd7e4cb3b6c55afbad7b2a47e9e92906c56741e5d5e040f4bc35afd29772a812ff426e00

Download Submit
memory/1416-133-0x0000000000000000-mapping.dmp

Download
memory/2364-136-0x0000000000000000-mapping.dmp

Download
memory/2364-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2364-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2364-140-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2364-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3768-132-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/3768-142-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/3768-143-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/4984-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads