pony | 203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983

Analysis

max time kernel
131s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe
Size

291KB
MD5

e1c3629119f5302d063ffdc6b12ea3b0
SHA1

f00fcee9d817012bd14477dc4ca1168a8768e4a2
SHA256

203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983
SHA512

a9973c250c8d0f58d66e490f0849ff521dbb8deb910999d136d12b59b1d55d7f13ecb8cba27229d3cede1cf9a92666026eef9d88d8c1c62f9455640eb5b66631
SSDEEP

6144:TTDGSslfdUY26SmrEsNU8BsR3E5BOiUgUAUaBvS9ltGrnRgCm:JsyUEYBscB13UAOenGl

Score

10^/10

pony credential_access discovery rat spyware stealer upx

Malware Config

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2252-31-0x0000000001EB0000-0x0000000001EC6000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 112	2252	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{6309c5e8-cf71-f152-4438-0838fc78b4dd}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6309c5e8-cf71-f152-4438-0838fc78b4dd}\u = "860049491"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6309c5e8-cf71-f152-4438-0838fc78b4dd}\cid = "1030994092354679840"	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
112	explorer.exe
112	explorer.exe
112	explorer.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 112	2252	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe	29
PID 2252 wrote to memory of 112	2252	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe	29
PID 2252 wrote to memory of 112	2252	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe	29
PID 2252 wrote to memory of 112	2252	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe	29
PID 2252 wrote to memory of 112	2252	203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe	29
PID 112 wrote to memory of 332	112	explorer.exe	2
PID 332 wrote to memory of 856	332	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:856

C:\Users\Admin\AppData\Local\Temp\203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe
"C:\Users\Admin\AppData\Local\Temp\203c5ba77074cc8c916e0c6d62dc7227a5bfbf83265ce620e83763f1c32c7983N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\explorer.exe
  000001D4*
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.DLL

Filesize
53KB

MD5
d3bd9c7e7a29daa24c66dc62cd5f5633

SHA1
3895247052b6244659e73334e6398677dafa0ac1

SHA256
6b87925d0e03ab5daa4760b1a62bed66c49cb489d011e2c9633eb0fe466df83f

SHA512
e243a2272887b02417b08b0d0728689c8f01cc57d473ed811ba98c2f5aa4d985d02d0fd7772bc33356474abcc815609ab7a6c0e905d6fe884fb7bc70bc67e9d0

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
d94d505ed9100ac58b405e9bce5e8520

SHA1
4c08fed67b0e9a835f6d534ff18fbf2fe2d87f52

SHA256
4b80fcef5097dba897fd1724eee57ddef71a4ccea8c27e3ce7cc0123b198dc62

SHA512
543f9a88036a0f458d27c601fda8d76cdc83d359ea21dd72c0f4d99731a9d6640829280d91270ff196c230ba14d4601fb9d696623a1b89daec199930b8809ce0

Download Submit
\Windows\assembly\GAC_32\Desktop.ini

Filesize
4KB

MD5
ff7d5ec20bf73c02317e7a740fffe018

SHA1
365ac8cfe5b939854cc1c341caf051bcc45f9372

SHA256
1e230847d7034f5ab3bf010f569315e00673859af0574fc9f915636ed905779a

SHA512
30854c0d703fd7c6cbc0769d9be4125baa2577ec529d5e48177a434685b66752fd79c50f0321324e23eeb985738f403347748afefae7d8a3bfad388a5b512a44

Download Submit
memory/112-9-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/112-13-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/112-5-0x0000000000060000-0x0000000000076000-memory.dmp

Filesize
88KB

Download
memory/112-2-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/332-32-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/332-20-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/332-19-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/856-39-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/856-44-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/856-50-0x0000000000860000-0x000000000086B000-memory.dmp

Filesize
44KB

Download
memory/856-45-0x0000000000860000-0x000000000086B000-memory.dmp

Filesize
44KB

Download
memory/856-43-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/856-35-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/2252-23-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2252-25-0x0000000000400000-0x000000000044CA00-memory.dmp

Filesize
306KB

Download
memory/2252-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2252-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2252-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2252-48-0x0000000000400000-0x000000000044CA00-memory.dmp

Filesize
306KB

Download
memory/2252-49-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2252-31-0x0000000001EB0000-0x0000000001EC6000-memory.dmp

Filesize
88KB

Download