pony | 63c825619e3cff8843b7ef1d81b493fa1addc20c548ac98010acc6afd254351a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22-09-2023 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Halkbank,pdf.exe
Size

791KB
MD5

3e1e8f6ddfe357c6ae9d073f79138291
SHA1

f232e9369b47d1b2a107b5b2b6c08a593b9f3ac6
SHA256

63c825619e3cff8843b7ef1d81b493fa1addc20c548ac98010acc6afd254351a
SHA512

5c24be4471bb05a2e9a700a705b6a94075610f339ee525f4c9b18b3f9a1ecff9c7dcd06c8021aae13b3ebb666ef3cd8378e28a34a734e6437e75655b0ace6a57
SSDEEP

12288:KK2mhAMJ/cPlcWOQlaVxmL9PdLkVxEKvz9bM8h7UH16kyc3HS4Mr2TWA/pw8XfU7:72O/GlcWOkWmL7du7AMkycLZpNpixjX9

Score

10^/10

pony collection discovery persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://co36686.twsite.de/chisom/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 3 IoCs

pid	Process
2792	qfe.exe
2568	qfe.exe
2572	RegSvcs.exe

Loads dropped DLL 6 IoCs

pid	Process
2836	Halkbank,pdf.exe
2836	Halkbank,pdf.exe
2836	Halkbank,pdf.exe
2836	Halkbank,pdf.exe
2792	qfe.exe
2568	qfe.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\gxu\\qfe.exe C:\\Users\\Admin\\AppData\\Roaming\\gxu\\nhb.lgr"	qfe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 2572	2568	qfe.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2792	qfe.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2572	RegSvcs.exe
Token: SeTcbPrivilege	2572	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2572	RegSvcs.exe
Token: SeCreateTokenPrivilege	2572	RegSvcs.exe
Token: SeBackupPrivilege	2572	RegSvcs.exe
Token: SeRestorePrivilege	2572	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2572	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2572	RegSvcs.exe
Token: SeImpersonatePrivilege	2572	RegSvcs.exe
Token: SeTcbPrivilege	2572	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2572	RegSvcs.exe
Token: SeCreateTokenPrivilege	2572	RegSvcs.exe
Token: SeBackupPrivilege	2572	RegSvcs.exe
Token: SeRestorePrivilege	2572	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2572	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2572	RegSvcs.exe
Token: SeImpersonatePrivilege	2572	RegSvcs.exe
Token: SeTcbPrivilege	2572	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2572	RegSvcs.exe
Token: SeCreateTokenPrivilege	2572	RegSvcs.exe
Token: SeBackupPrivilege	2572	RegSvcs.exe
Token: SeRestorePrivilege	2572	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2572	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2572	RegSvcs.exe
Token: SeImpersonatePrivilege	2572	RegSvcs.exe
Token: SeTcbPrivilege	2572	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2572	RegSvcs.exe
Token: SeCreateTokenPrivilege	2572	RegSvcs.exe
Token: SeBackupPrivilege	2572	RegSvcs.exe
Token: SeRestorePrivilege	2572	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2572	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2572	RegSvcs.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2792	2836	Halkbank,pdf.exe	28
PID 2836 wrote to memory of 2792	2836	Halkbank,pdf.exe	28
PID 2836 wrote to memory of 2792	2836	Halkbank,pdf.exe	28
PID 2836 wrote to memory of 2792	2836	Halkbank,pdf.exe	28
PID 2836 wrote to memory of 2792	2836	Halkbank,pdf.exe	28
PID 2836 wrote to memory of 2792	2836	Halkbank,pdf.exe	28
PID 2836 wrote to memory of 2792	2836	Halkbank,pdf.exe	28
PID 2792 wrote to memory of 2568	2792	qfe.exe	29
PID 2792 wrote to memory of 2568	2792	qfe.exe	29
PID 2792 wrote to memory of 2568	2792	qfe.exe	29
PID 2792 wrote to memory of 2568	2792	qfe.exe	29
PID 2792 wrote to memory of 2568	2792	qfe.exe	29
PID 2792 wrote to memory of 2568	2792	qfe.exe	29
PID 2792 wrote to memory of 2568	2792	qfe.exe	29
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2568 wrote to memory of 2572	2568	qfe.exe	30
PID 2572 wrote to memory of 1196	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 1196	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 1196	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 1196	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 1196	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 1196	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 1196	2572	RegSvcs.exe	32

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Roaming\gxu\qfe.exe
  "C:\Users\Admin\AppData\Roaming\gxu\qfe.exe" nhb.lgr
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Roaming\gxu\qfe.exe
    C:\Users\Admin\AppData\Roaming\gxu\qfe.exe C:\Users\Admin\AppData\Roaming\gxu\QUVHA
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook accounts
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_win_path
      PID:2572
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\259427915.bat" "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe" "
        5⤵
        
        PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259427915.bat

Filesize
94B

MD5
3880eeb1c736d853eb13b44898b718ab

SHA1
4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

SHA256
936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

SHA512
3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\259427915.bat

Filesize
94B

MD5
3880eeb1c736d853eb13b44898b718ab

SHA1
4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

SHA256
936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

SHA512
3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
33KB

MD5
1bad37c4066ab7cca70d401b4cead575

SHA1
9bbd3ff5a95a0752bc88cc884f976f19890bb8d8

SHA256
167e5a52f5b44996392c8fb01be47903a44d0a188a074e49a91838e92a71c5b7

SHA512
5e1b33ad4e0670c391d8445f12bc0ff54a7a868318fa387caaffa2b5c517e0391c9f19f0f64bb763024defdabdbd1fb1793ebaefe53f04add782a1b6c7a51070

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
33KB

MD5
1bad37c4066ab7cca70d401b4cead575

SHA1
9bbd3ff5a95a0752bc88cc884f976f19890bb8d8

SHA256
167e5a52f5b44996392c8fb01be47903a44d0a188a074e49a91838e92a71c5b7

SHA512
5e1b33ad4e0670c391d8445f12bc0ff54a7a868318fa387caaffa2b5c517e0391c9f19f0f64bb763024defdabdbd1fb1793ebaefe53f04add782a1b6c7a51070

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\QUVHA

Filesize
90KB

MD5
0f0519df4fa77ec4970bc71d3e4d8e63

SHA1
6e4ed0bf6210613f37e3d6a31a45ffb22bd81e04

SHA256
6bf187956e114dd431268834d13dd39585d5771160124617864dcad6840c23d5

SHA512
4a30b14eb5ca1e4e8c9ce43231d3167c8bc66807c4c696ee2d8459143256e9be7383e9d169d492686b536e2734353c1615eeeb60cf2c653384e2428fd087eee9

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\ebp.ico

Filesize
400KB

MD5
ee6e4ed60d5919a910ba3d661f548447

SHA1
e064bf0ba05a2fc2ee945cb3344f9593eaec8d68

SHA256
2c6ea6b2e2b7657bd6161fbbc9723f7e143aebf03c23946aafd85f421fecaf39

SHA512
4f5b2df6b4899e832b043908afff62ec283c14e30f065829ff3a2690d3f9baa66e759e73488eb8d733228ec6d123127726bca1c6b6f5558ec7ef7784064c542c

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\lmi

Filesize
1KB

MD5
7fca07e04882ef4b440ac5d485941bcb

SHA1
50c899e1943fc927b0ec56233ef4dd756338414d

SHA256
74b1bbe4bc2e091a04d00c07a89d9e02dfa1f8f01da089b633a431a0a52a56b7

SHA512
f226c939f89f2d4eb7ab49adf088fe59a8c64ce3d73dcb54cef15db660c5cf1f3b7a8d56f6b1643bbdf7347f61adb1286888e939096257f48815d9b6ac69e9d2

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\nhb.lgr

Filesize
396KB

MD5
9ac76b89f4eb78d9b85c79f8fe1b01c3

SHA1
97d07bdeee56489e181e18e7df295ee71543155f

SHA256
22a9b29740da718acf162cfdb8b143f6faad7ae41aa10ba1bd180886316e2163

SHA512
4490a9c1312fa7a2f58427a06183c28dc82ba38d987d4d98d26638816ab374e9ac2652321a466b4c5fc0804f5447828547b79cfc74ecf90eab075e4f74c9c330

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
33KB

MD5
1bad37c4066ab7cca70d401b4cead575

SHA1
9bbd3ff5a95a0752bc88cc884f976f19890bb8d8

SHA256
167e5a52f5b44996392c8fb01be47903a44d0a188a074e49a91838e92a71c5b7

SHA512
5e1b33ad4e0670c391d8445f12bc0ff54a7a868318fa387caaffa2b5c517e0391c9f19f0f64bb763024defdabdbd1fb1793ebaefe53f04add782a1b6c7a51070

Download Submit
\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
memory/2572-62-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2572-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2572-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2572-65-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2572-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2572-68-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2572-70-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2572-60-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download