pony | a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7

Analysis

max time kernel
238s
max time network
347s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Size

154KB
MD5

68c7afea11aee647bd6f484cc497ac0f
SHA1

b3f55801e4a9fd9dc3974a08bcdc2686a465ea90
SHA256

a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7
SHA512

0bae9c1119e48c132d9cbc4121bda6ee712b980f4ecb8d327d16303a68174169d2dfcb9cb8cff9f1617b152d6628fe8587f323644e428c69471f095e8bc68a43
SSDEEP

3072:o4W5H4mNr9+819Ih/vxPNowmbpVOhKXFG2L:dW3r9xFb3AKXXL

Score

10^/10

pony collection discovery rat spyware stealer

Malware Config

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

description	pid	process
Token: SeImpersonatePrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Token: SeTcbPrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Token: SeChangeNotifyPrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Token: SeCreateTokenPrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Token: SeBackupPrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Token: SeRestorePrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Token: SeIncreaseQuotaPrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
Token: SeAssignPrimaryTokenPrivilege	940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

pid process

940 a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

pid	process
940	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

outlook_win_path 1 IoCs

Processes:

a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe

C:\Users\Admin\AppData\Local\Temp\a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe
"C:\Users\Admin\AppData\Local\Temp\a59bee6368aaa97df00842e49890b3857043ddb2912f417060076805af544fc7.exe"
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- outlook_win_path
PID:940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x00000000002D0000-0x00000000002FF000-memory.dmp

Filesize
188KB

Download
memory/940-55-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/940-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/940-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download