pony | 396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea

General

Target

396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
Size

314KB
MD5

6e8ea0d5d276e80dbf9bf1f29f44fc7f
SHA1

d14e5b1043211d8db975433f8e0c523c940aa817
SHA256

396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea
SHA512

07e5ea129536f0e89ef178e81d32c57a6b7508e86805a3ef6999322c679093428146359c7a1592852f4d48e6b582cf355dd31ff9a0b4f3d8173e8ae36d0ed59e
SSDEEP

6144:56F8sG/w0QSLZfGgeVfSn0pRQFU4In9rGZqJ7l3mo2Nkj+voxEvTE:565xTSLZWqn0kr0yZM7l7fj+cEvT

Score

10^/10

pony rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://asusoftware.no-ip.org/pon/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

description	pid	process	target process
PID 1348 set thread context of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

description pid process

Token: SeDebugPrivilege 1348 396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

description	pid	process
Token: SeDebugPrivilege	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

description	pid	process	target process
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
PID 1348 wrote to memory of 108	1348	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe	396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe

C:\Users\Admin\AppData\Local\Temp\396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
"C:\Users\Admin\AppData\Local\Temp\396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348

C:\Users\Admin\AppData\Local\Temp\396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe
"C:\Users\Admin\AppData\Local\Temp\396c267fa14c0460c725374b7787098317deb7364c995ecdaa7d945f5f6f55ea.exe"
2⤵
PID:108

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-57-0x0000000000070000-0x0000000000089000-memory.dmp

Filesize
100KB

Download
memory/108-58-0x0000000000070000-0x0000000000089000-memory.dmp

Filesize
100KB

Download
memory/108-60-0x0000000000070000-0x0000000000089000-memory.dmp

Filesize
100KB

Download
memory/108-61-0x0000000000070000-0x0000000000089000-memory.dmp

Filesize
100KB

Download
memory/108-64-0x00000000004100CA-mapping.dmp

Download
memory/108-66-0x0000000000070000-0x0000000000089000-memory.dmp

Filesize
100KB

Download
memory/1348-54-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download
memory/1348-55-0x0000000074AF0000-0x000000007509B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-56-0x0000000074AF0000-0x000000007509B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-65-0x0000000074AF0000-0x000000007509B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads