pony | e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5

General

Target

e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Size

194KB
MD5

3488f48b13ce7dfb429dc985783ec432
SHA1

a9d2426102ab7264cdf22e0a22b453e979196919
SHA256

e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5
SHA512

a58aa9be539c16e64dbd26db4fddc8f2411707a4c19ebc3c1e11619ff52e9310d3bea5cf01e0377e1c9ea3de2062f6b5612e8b61781ecc586c6dd7808dc9f41b
SSDEEP

3072:uAFrJ+2f9rAQj16WKkDxyndO62xLtc7AfOGC1K5RB2tHsT:uYd+AAQj0WKkDknwPLJmGCs5HqsT

Score

10^/10

pony collection discovery persistence rat spyware stealer upx

Malware Config

Extracted

Family

pony

C2

http://saraconnor4you.com/gate.php

Attributes

payload_url
http://www.gt-moebel.de/administrator/templates/system/images/png.exe

http://fenster-metallbau-lahntal.de/um-formmailer/templates/png.exe

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Executes dropped EXE 1 IoCs

Processes:

sysxpnld.exe

pid process

1720 sysxpnld.exe

pid	process
1720	sysxpnld.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2000-56-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/2000-58-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1720-65-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1720-67-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1720-68-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1496 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe

pid process

2000 e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1496	cmd.exe

pid	process
2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

sysxpnld.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	sysxpnld.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

sysxpnld.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	sysxpnld.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sysxpnld.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	sysxpnld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SYS_UPDATE_2864E379BB0537CDE68283A = "C:\\Users\\Admin\\AppData\\Roaming\\WinRAR\\sysxpnld.exe"	sysxpnld.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exesysxpnld.exe

description	pid	process
Token: SeImpersonatePrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeTcbPrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeChangeNotifyPrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeCreateTokenPrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeBackupPrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeRestorePrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeIncreaseQuotaPrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeAssignPrimaryTokenPrivilege	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
Token: SeImpersonatePrivilege	1720	sysxpnld.exe
Token: SeTcbPrivilege	1720	sysxpnld.exe
Token: SeChangeNotifyPrivilege	1720	sysxpnld.exe
Token: SeCreateTokenPrivilege	1720	sysxpnld.exe
Token: SeBackupPrivilege	1720	sysxpnld.exe
Token: SeRestorePrivilege	1720	sysxpnld.exe
Token: SeIncreaseQuotaPrivilege	1720	sysxpnld.exe
Token: SeAssignPrimaryTokenPrivilege	1720	sysxpnld.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe

description	pid	process	target process
PID 2000 wrote to memory of 1720	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	sysxpnld.exe
PID 2000 wrote to memory of 1720	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	sysxpnld.exe
PID 2000 wrote to memory of 1720	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	sysxpnld.exe
PID 2000 wrote to memory of 1720	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	sysxpnld.exe
PID 2000 wrote to memory of 1496	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	cmd.exe
PID 2000 wrote to memory of 1496	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	cmd.exe
PID 2000 wrote to memory of 1496	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	cmd.exe
PID 2000 wrote to memory of 1496	2000	e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe	cmd.exe

outlook_win_path 1 IoCs

Processes:

sysxpnld.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	sysxpnld.exe

C:\Users\Admin\AppData\Local\Temp\e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe
"C:\Users\Admin\AppData\Local\Temp\e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Roaming\WinRAR\sysxpnld.exe
"C:\Users\Admin\AppData\Roaming\WinRAR\sysxpnld.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:1720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\E0DBBC~1.EXE" > NUL
2⤵
- Deletes itself
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

2

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinRAR\sysxpnld.exe
Filesize
194KB

MD5
3488f48b13ce7dfb429dc985783ec432

SHA1
a9d2426102ab7264cdf22e0a22b453e979196919

SHA256
e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5

SHA512
a58aa9be539c16e64dbd26db4fddc8f2411707a4c19ebc3c1e11619ff52e9310d3bea5cf01e0377e1c9ea3de2062f6b5612e8b61781ecc586c6dd7808dc9f41b

Download Submit
\Users\Admin\AppData\Roaming\WinRAR\sysxpnld.exe
Filesize
194KB

MD5
3488f48b13ce7dfb429dc985783ec432

SHA1
a9d2426102ab7264cdf22e0a22b453e979196919

SHA256
e0dbbce3b993e5d2ba90ab13bbe2607e531a424bebba9b6cadcd840efb9c62a5

SHA512
a58aa9be539c16e64dbd26db4fddc8f2411707a4c19ebc3c1e11619ff52e9310d3bea5cf01e0377e1c9ea3de2062f6b5612e8b61781ecc586c6dd7808dc9f41b

Download Submit
memory/1496-63-0x0000000000000000-mapping.dmp

Download
memory/1720-60-0x0000000000000000-mapping.dmp

Download
memory/1720-64-0x0000000002260000-0x00000000023BD000-memory.dmp

Filesize
1.4MB

Download
memory/1720-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1720-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1720-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2000-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/2000-55-0x0000000001FF0000-0x000000000214D000-memory.dmp

Filesize
1.4MB

Download
memory/2000-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2000-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads