pony | bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce

General

Target

bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
Size

254KB
MD5

8c89b6d5c462d5acf263595847ec4b73
SHA1

4470bc92f00abc47253bdfa44bc31c7ae7caa45f
SHA256

bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce
SHA512

8b6e4406be7a7e22ca5029e74fe9c24ef9d6a384098ed047d847297f578ab8d5601708c403f168a0c990763b61ae945e44ef07419896f7fd6f2f4c5162fb37c1
SSDEEP

3072:QQorU9oV62DZCVKxHvhNmQtsZv2Wbacl7U6TxnwXPq2vAlywrKft4ZZf3FPkAXvt:TorU9oV6oxHpLtS72cBfwC240mF

Score

10^/10

pony collection persistence rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://shoptoolgtav.craym.eu/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk"	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe

description	pid	process	target process
PID 4588 set thread context of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe

pid	process
4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
Token: SeImpersonatePrivilege	4248	AppLaunch.exe
Token: SeTcbPrivilege	4248	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4248	AppLaunch.exe
Token: SeCreateTokenPrivilege	4248	AppLaunch.exe
Token: SeBackupPrivilege	4248	AppLaunch.exe
Token: SeRestorePrivilege	4248	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4248	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AppLaunch.exe
Token: SeImpersonatePrivilege	4248	AppLaunch.exe
Token: SeTcbPrivilege	4248	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4248	AppLaunch.exe
Token: SeCreateTokenPrivilege	4248	AppLaunch.exe
Token: SeBackupPrivilege	4248	AppLaunch.exe
Token: SeRestorePrivilege	4248	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4248	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AppLaunch.exe
Token: SeImpersonatePrivilege	4248	AppLaunch.exe
Token: SeTcbPrivilege	4248	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4248	AppLaunch.exe
Token: SeCreateTokenPrivilege	4248	AppLaunch.exe
Token: SeBackupPrivilege	4248	AppLaunch.exe
Token: SeRestorePrivilege	4248	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4248	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AppLaunch.exe
Token: SeImpersonatePrivilege	4248	AppLaunch.exe
Token: SeTcbPrivilege	4248	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4248	AppLaunch.exe
Token: SeCreateTokenPrivilege	4248	AppLaunch.exe
Token: SeBackupPrivilege	4248	AppLaunch.exe
Token: SeRestorePrivilege	4248	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4248	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AppLaunch.exe
Token: SeImpersonatePrivilege	4248	AppLaunch.exe
Token: SeTcbPrivilege	4248	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4248	AppLaunch.exe
Token: SeCreateTokenPrivilege	4248	AppLaunch.exe
Token: SeBackupPrivilege	4248	AppLaunch.exe
Token: SeRestorePrivilege	4248	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4248	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AppLaunch.exe
Token: SeImpersonatePrivilege	4248	AppLaunch.exe
Token: SeTcbPrivilege	4248	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4248	AppLaunch.exe
Token: SeCreateTokenPrivilege	4248	AppLaunch.exe
Token: SeBackupPrivilege	4248	AppLaunch.exe
Token: SeRestorePrivilege	4248	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4248	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe

description	pid	process	target process
PID 4588 wrote to memory of 4272	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	CMD.exe
PID 4588 wrote to memory of 4272	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	CMD.exe
PID 4588 wrote to memory of 4272	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	CMD.exe
PID 4588 wrote to memory of 3356	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	CMD.exe
PID 4588 wrote to memory of 3356	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	CMD.exe
PID 4588 wrote to memory of 3356	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	CMD.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe
PID 4588 wrote to memory of 4248	4588	bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe	AppLaunch.exe

outlook_win_path 1 IoCs

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
"C:\Users\Admin\AppData\Local\Temp\bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:4272

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:3356

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\AppLaunch.exe"
2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:4248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

2

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3356-134-0x0000000000000000-mapping.dmp

Download
memory/4248-135-0x0000000000000000-mapping.dmp

Download
memory/4248-136-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4248-138-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4248-139-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4248-140-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4272-133-0x0000000000000000-mapping.dmp

Download
memory/4588-132-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads