pony | cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee

Analysis

max time kernel
24s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 17:39

Target

cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe
Size

128KB
MD5

43a04b8fe95da517033a4cc23c6435fa
SHA1

f74d331bd26f6f3441a65e4a82354d0b52a4a070
SHA256

cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee
SHA512

a2864336c54193918b6fb61a5fdc161c37ab241d54a87a1c4a7e726a2c97a344bf870ee94ad44edb06ebee05d3061a69e2f871a7bb1a33ea5958262450045324
SSDEEP

3072:fLv7moIzz+nOZAUMKed2e9bl2Fd9WpaJxaLuBmQ:jvy+nIAUj5wbOaazaLuBmQ

Score

10^/10

Family

pony

http://67.215.225.205:8080/forum/viewtopic.php

http://122.201.102.69:8080/forum/viewtopic.php

Attributes

payload_url
http://realitycoaching.es/23sf.exe

http://kms-anwaelte.de/mvCo.exe

http://easyinbox.net/Zsh.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1520	2032	cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe	28
PID 2032 wrote to memory of 1520	2032	cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe	28
PID 2032 wrote to memory of 1520	2032	cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe	28
PID 2032 wrote to memory of 1520	2032	cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe	28

C:\Users\Admin\AppData\Local\Temp\cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe
"C:\Users\Admin\AppData\Local\Temp\cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe
  "C:\Users\Admin\AppData\Local\Temp\cb2746c1f7d5e484ec8b6757e840f3560c028d70f4843ab5b291da4ae0ce4aee.exe"
  2⤵
  PID:1520

memory/2032-54-0x0000000001170000-0x0000000001194000-memory.dmp

Filesize
144KB

Download
memory/2032-55-0x0000000001170000-0x0000000001194000-memory.dmp

Filesize
144KB

Download