pony | 9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9

General

Target

9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe
Size

278KB
MD5

d0326f8847dd8b0f85da7c203742773b
SHA1

8dafd88fd807b74a88792ad3878ffec3504c6539
SHA256

9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9
SHA512

0a2eee9d57dcce253c41b6ef7ee92772d5166782e8f9dcbac9570f2c758b55b95d27f0247653e56d7e97cfb14b1b5aef193a7c230507228de61fb0289ea69deb
SSDEEP

6144:KQPqT46Et9e0OjlKZbc+TsGoN3gnLapsG6Q2zF2eXNiA:K4zVI0fce4M66hPNi

Score

10^/10

pony collection rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://91.220.163.21/pony2/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe

description	pid	process	target process
PID 1492 set thread context of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe
Token: SeImpersonatePrivilege	1312	vbc.exe
Token: SeTcbPrivilege	1312	vbc.exe
Token: SeChangeNotifyPrivilege	1312	vbc.exe
Token: SeCreateTokenPrivilege	1312	vbc.exe
Token: SeBackupPrivilege	1312	vbc.exe
Token: SeRestorePrivilege	1312	vbc.exe
Token: SeIncreaseQuotaPrivilege	1312	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	1312	vbc.exe
Token: SeImpersonatePrivilege	1312	vbc.exe
Token: SeTcbPrivilege	1312	vbc.exe
Token: SeChangeNotifyPrivilege	1312	vbc.exe
Token: SeCreateTokenPrivilege	1312	vbc.exe
Token: SeBackupPrivilege	1312	vbc.exe
Token: SeRestorePrivilege	1312	vbc.exe
Token: SeIncreaseQuotaPrivilege	1312	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	1312	vbc.exe
Token: SeImpersonatePrivilege	1312	vbc.exe
Token: SeTcbPrivilege	1312	vbc.exe
Token: SeChangeNotifyPrivilege	1312	vbc.exe
Token: SeCreateTokenPrivilege	1312	vbc.exe
Token: SeBackupPrivilege	1312	vbc.exe
Token: SeRestorePrivilege	1312	vbc.exe
Token: SeIncreaseQuotaPrivilege	1312	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	1312	vbc.exe
Token: SeImpersonatePrivilege	1312	vbc.exe
Token: SeTcbPrivilege	1312	vbc.exe
Token: SeChangeNotifyPrivilege	1312	vbc.exe
Token: SeCreateTokenPrivilege	1312	vbc.exe
Token: SeBackupPrivilege	1312	vbc.exe
Token: SeRestorePrivilege	1312	vbc.exe
Token: SeIncreaseQuotaPrivilege	1312	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	1312	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exevbc.exe

description	pid	process	target process
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1492 wrote to memory of 1312	1492	9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe	vbc.exe
PID 1312 wrote to memory of 1228	1312	vbc.exe	cmd.exe
PID 1312 wrote to memory of 1228	1312	vbc.exe	cmd.exe
PID 1312 wrote to memory of 1228	1312	vbc.exe	cmd.exe
PID 1312 wrote to memory of 1228	1312	vbc.exe	cmd.exe

outlook_win_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

C:\Users\Admin\AppData\Local\Temp\9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe
"C:\Users\Admin\AppData\Local\Temp\9b7fb8ee9e212cf92292c0a71df21e9558201bc8b53cf994279d091ddc4b47e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7132131.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" "
3⤵
PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7132131.bat
Filesize
94B

MD5
3880eeb1c736d853eb13b44898b718ab

SHA1
4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

SHA256
936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

SHA512
3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Download Submit
memory/1228-71-0x0000000000000000-mapping.dmp

Download
memory/1312-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-66-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-58-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-60-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-64-0x0000000000410EAD-mapping.dmp

Download
memory/1312-72-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-57-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-70-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1312-69-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1492-68-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1492-55-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads