pony | 63c825619e3cff8843b7ef1d81b493fa1addc20c548ac98010acc6afd254351a

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2023 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Halkbank,pdf.exe
Size

791KB
MD5

3e1e8f6ddfe357c6ae9d073f79138291
SHA1

f232e9369b47d1b2a107b5b2b6c08a593b9f3ac6
SHA256

63c825619e3cff8843b7ef1d81b493fa1addc20c548ac98010acc6afd254351a
SHA512

5c24be4471bb05a2e9a700a705b6a94075610f339ee525f4c9b18b3f9a1ecff9c7dcd06c8021aae13b3ebb666ef3cd8378e28a34a734e6437e75655b0ace6a57
SSDEEP

12288:KK2mhAMJ/cPlcWOQlaVxmL9PdLkVxEKvz9bM8h7UH16kyc3HS4Mr2TWA/pw8XfU7:72O/GlcWOkWmL7du7AMkycLZpNpixjX9

Score

10^/10

pony collection discovery persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://co36686.twsite.de/chisom/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	Halkbank,pdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	RegSvcs.exe

Executes dropped EXE 3 IoCs

pid	Process
1308	qfe.exe
3012	qfe.exe
2200	RegSvcs.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\gxu\\qfe.exe C:\\Users\\Admin\\AppData\\Roaming\\gxu\\nhb.lgr"	qfe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2200	3012	qfe.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1308	qfe.exe
1308	qfe.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2200	RegSvcs.exe
Token: SeTcbPrivilege	2200	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2200	RegSvcs.exe
Token: SeCreateTokenPrivilege	2200	RegSvcs.exe
Token: SeBackupPrivilege	2200	RegSvcs.exe
Token: SeRestorePrivilege	2200	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2200	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2200	RegSvcs.exe
Token: SeImpersonatePrivilege	2200	RegSvcs.exe
Token: SeTcbPrivilege	2200	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2200	RegSvcs.exe
Token: SeCreateTokenPrivilege	2200	RegSvcs.exe
Token: SeBackupPrivilege	2200	RegSvcs.exe
Token: SeRestorePrivilege	2200	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2200	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2200	RegSvcs.exe
Token: SeImpersonatePrivilege	2200	RegSvcs.exe
Token: SeTcbPrivilege	2200	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2200	RegSvcs.exe
Token: SeCreateTokenPrivilege	2200	RegSvcs.exe
Token: SeBackupPrivilege	2200	RegSvcs.exe
Token: SeRestorePrivilege	2200	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2200	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2200	RegSvcs.exe
Token: SeImpersonatePrivilege	2200	RegSvcs.exe
Token: SeTcbPrivilege	2200	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2200	RegSvcs.exe
Token: SeCreateTokenPrivilege	2200	RegSvcs.exe
Token: SeBackupPrivilege	2200	RegSvcs.exe
Token: SeRestorePrivilege	2200	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2200	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2200	RegSvcs.exe
Token: SeImpersonatePrivilege	2200	RegSvcs.exe
Token: SeTcbPrivilege	2200	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2200	RegSvcs.exe
Token: SeCreateTokenPrivilege	2200	RegSvcs.exe
Token: SeBackupPrivilege	2200	RegSvcs.exe
Token: SeRestorePrivilege	2200	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2200	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2200	RegSvcs.exe
Token: SeImpersonatePrivilege	2200	RegSvcs.exe
Token: SeTcbPrivilege	2200	RegSvcs.exe
Token: SeChangeNotifyPrivilege	2200	RegSvcs.exe
Token: SeCreateTokenPrivilege	2200	RegSvcs.exe
Token: SeBackupPrivilege	2200	RegSvcs.exe
Token: SeRestorePrivilege	2200	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2200	RegSvcs.exe
Token: SeAssignPrimaryTokenPrivilege	2200	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1308	3024	Halkbank,pdf.exe	86
PID 3024 wrote to memory of 1308	3024	Halkbank,pdf.exe	86
PID 3024 wrote to memory of 1308	3024	Halkbank,pdf.exe	86
PID 1308 wrote to memory of 3012	1308	qfe.exe	88
PID 1308 wrote to memory of 3012	1308	qfe.exe	88
PID 1308 wrote to memory of 3012	1308	qfe.exe	88
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 3012 wrote to memory of 2200	3012	qfe.exe	95
PID 2200 wrote to memory of 3444	2200	RegSvcs.exe	100
PID 2200 wrote to memory of 3444	2200	RegSvcs.exe	100
PID 2200 wrote to memory of 3444	2200	RegSvcs.exe	100

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Roaming\gxu\qfe.exe
  "C:\Users\Admin\AppData\Roaming\gxu\qfe.exe" nhb.lgr
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Roaming\gxu\qfe.exe
    C:\Users\Admin\AppData\Roaming\gxu\qfe.exe C:\Users\Admin\AppData\Roaming\gxu\IGREQ
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Accesses Microsoft Outlook accounts
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_win_path
      PID:2200
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240628781.bat" "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe" "
        5⤵
        
        PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240628781.bat

Filesize
94B

MD5
3880eeb1c736d853eb13b44898b718ab

SHA1
4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

SHA256
936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

SHA512
3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
33KB

MD5
9a2d1dae23c1074d4f56a598462e0942

SHA1
8a7bd9e421c676000571bf7f1155825d43d7469d

SHA256
8efa30ce5069f173b32b625665708ee9a2857d2816576f04701e53484a877e56

SHA512
39bbec7f4ae1e804437fea50cd8168b2574a6032e152e45d17eea65dfa4b4c795e7a9034af11523315a6b8e9f2f471162147be48873fc315137914170fffdc0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
33KB

MD5
9a2d1dae23c1074d4f56a598462e0942

SHA1
8a7bd9e421c676000571bf7f1155825d43d7469d

SHA256
8efa30ce5069f173b32b625665708ee9a2857d2816576f04701e53484a877e56

SHA512
39bbec7f4ae1e804437fea50cd8168b2574a6032e152e45d17eea65dfa4b4c795e7a9034af11523315a6b8e9f2f471162147be48873fc315137914170fffdc0e

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\IGREQ

Filesize
90KB

MD5
0f0519df4fa77ec4970bc71d3e4d8e63

SHA1
6e4ed0bf6210613f37e3d6a31a45ffb22bd81e04

SHA256
6bf187956e114dd431268834d13dd39585d5771160124617864dcad6840c23d5

SHA512
4a30b14eb5ca1e4e8c9ce43231d3167c8bc66807c4c696ee2d8459143256e9be7383e9d169d492686b536e2734353c1615eeeb60cf2c653384e2428fd087eee9

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\ebp.ico

Filesize
400KB

MD5
ee6e4ed60d5919a910ba3d661f548447

SHA1
e064bf0ba05a2fc2ee945cb3344f9593eaec8d68

SHA256
2c6ea6b2e2b7657bd6161fbbc9723f7e143aebf03c23946aafd85f421fecaf39

SHA512
4f5b2df6b4899e832b043908afff62ec283c14e30f065829ff3a2690d3f9baa66e759e73488eb8d733228ec6d123127726bca1c6b6f5558ec7ef7784064c542c

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\lmi

Filesize
1KB

MD5
7fca07e04882ef4b440ac5d485941bcb

SHA1
50c899e1943fc927b0ec56233ef4dd756338414d

SHA256
74b1bbe4bc2e091a04d00c07a89d9e02dfa1f8f01da089b633a431a0a52a56b7

SHA512
f226c939f89f2d4eb7ab49adf088fe59a8c64ce3d73dcb54cef15db660c5cf1f3b7a8d56f6b1643bbdf7347f61adb1286888e939096257f48815d9b6ac69e9d2

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\nhb.lgr

Filesize
396KB

MD5
9ac76b89f4eb78d9b85c79f8fe1b01c3

SHA1
97d07bdeee56489e181e18e7df295ee71543155f

SHA256
22a9b29740da718acf162cfdb8b143f6faad7ae41aa10ba1bd180886316e2163

SHA512
4490a9c1312fa7a2f58427a06183c28dc82ba38d987d4d98d26638816ab374e9ac2652321a466b4c5fc0804f5447828547b79cfc74ecf90eab075e4f74c9c330

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\gxu\qfe.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
memory/2200-53-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2200-57-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2200-58-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2200-62-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download