pony | 15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:12

Target

15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
Size

325KB
MD5

b13caff2276a8f17bf68e843be02c45b
SHA1

dd11387d2c1005ae3859cff92a5cab567f57da0f
SHA256

15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376
SHA512

49e728f4efc821e6812ff179736ee17b6280c9079c1d2e6c4d21f249127d8d0887b4b3502fc189c1f3d9e6589a10b4a2ba90a7d4f9d0f7021d5a63a9d7c01e26
SSDEEP

6144:sgnWaCItMOMDdFzi8ILvQ/d+ZlCbruezJMuinzG:VWWtMnJGreVo

Score

10^/10

Family

pony

http://91.220.163.21/pony/gate.php

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of SetThreadContext 1 IoCs

Processes:

15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe

description	pid	process	target process
PID 2500 set thread context of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe

description pid process

Token: SeDebugPrivilege 2500 15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe

description	pid	process
Token: SeDebugPrivilege	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe

description	pid	process	target process
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
PID 2500 wrote to memory of 2972	2500	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe	15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe

C:\Users\Admin\AppData\Local\Temp\15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
"C:\Users\Admin\AppData\Local\Temp\15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe
  "C:\Users\Admin\AppData\Local\Temp\15222b4e70086af157c40c87125dd18449828ca5037a247eff79b05f6f51c376.exe"
  2⤵
  PID:2972

memory/2500-132-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2500-133-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2500-138-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2972-134-0x0000000000000000-mapping.dmp

Download
memory/2972-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2972-136-0x00000000005B0000-0x00000000005C9000-memory.dmp

Filesize
100KB

Download