poullight | abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186

General

Target

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
Size

4.8MB
MD5

45f8507e73bdce9b9e1467709d29d5b0
SHA1

bc96a4350d48c08b08207c82d14ff2392f24aa8e
SHA256

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186
SHA512

2b05dea1ff7ba6ce3c62519f606943c962c496e189f6c69353f07549f1b3d4a0c3ef9517cc7248061fef692628d632e734594fe906739078b89868e7a9cb4e3a

Score

10^/10

poullight spyware stealer trojan upx

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3744-140-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight

Executes dropped EXE 2 IoCs

Processes:

Gvkmyonftrbtmminstaller_03-19-15(2).exeGvkmyonftrbtmminstaller_03-19-15(2).exe

pid process

3636 Gvkmyonftrbtmminstaller_03-19-15(2).exe
3772 Gvkmyonftrbtmminstaller_03-19-15(2).exe

pid	process
3636	Gvkmyonftrbtmminstaller_03-19-15(2).exe
3772	Gvkmyonftrbtmminstaller_03-19-15(2).exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe	upx
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe	upx
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeWScript.exeGvkmyonftrbtmminstaller_03-19-15(2).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Gvkmyonftrbtmminstaller_03-19-15(2).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

description	pid	process	target process
PID 3672 set thread context of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeabe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

pid	process
3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
3744	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
3744	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeabe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

description	pid	process
Token: SeDebugPrivilege	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
Token: SeDebugPrivilege	3744	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Gvkmyonftrbtmminstaller_03-19-15(2).exeGvkmyonftrbtmminstaller_03-19-15(2).exe

pid process

3636 Gvkmyonftrbtmminstaller_03-19-15(2).exe
3772 Gvkmyonftrbtmminstaller_03-19-15(2).exe

pid	process
3636	Gvkmyonftrbtmminstaller_03-19-15(2).exe
3772	Gvkmyonftrbtmminstaller_03-19-15(2).exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeWScript.exeGvkmyonftrbtmminstaller_03-19-15(2).exe

C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
"C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Qvuuikpdtgjaw.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3792

C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe
"C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636

C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe
"C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe" spawn
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3772

C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
2⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe
MD5
3349082f26ecd031f089a42d5a3137bc

SHA1
8b4b8fa4e110c92ef420cbc27cdd1cffe1bfec1b

SHA256
cb15de3436bfdc7d30ccacd99d38766b7a47282e32c778437852305787f9d5c9

SHA512
ef181658d49ba5aa23ac44fb7fd1f836f276be6097f8b9e1a59d0d21e53ad1a4a40f269d4a4e437c6f29c659144657e873b82ef069aa9237ac9492b9be6f892c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe
MD5
3349082f26ecd031f089a42d5a3137bc

SHA1
8b4b8fa4e110c92ef420cbc27cdd1cffe1bfec1b

SHA256
cb15de3436bfdc7d30ccacd99d38766b7a47282e32c778437852305787f9d5c9

SHA512
ef181658d49ba5aa23ac44fb7fd1f836f276be6097f8b9e1a59d0d21e53ad1a4a40f269d4a4e437c6f29c659144657e873b82ef069aa9237ac9492b9be6f892c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe
MD5
3349082f26ecd031f089a42d5a3137bc

SHA1
8b4b8fa4e110c92ef420cbc27cdd1cffe1bfec1b

SHA256
cb15de3436bfdc7d30ccacd99d38766b7a47282e32c778437852305787f9d5c9

SHA512
ef181658d49ba5aa23ac44fb7fd1f836f276be6097f8b9e1a59d0d21e53ad1a4a40f269d4a4e437c6f29c659144657e873b82ef069aa9237ac9492b9be6f892c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qvuuikpdtgjaw.vbs
MD5
7aeadae85f43cda4f8f498f5b8605602

SHA1
12c0bdf35a08ba0f79a0cbe8c1638b3eb740634b

SHA256
bf2d3822304f09d5657f0241e058ca7b497d35ed6e804b3e666fd64f1f555057

SHA512
6488fc5b353d3cbb49faffec6f20742a4f20f59126afe11ada2de9bcbd8bd98f5bc270e3d545b5ad835ae97f61b835b579666331058f7cba3bf2249764b3f30f

Download Submit
memory/3636-142-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/3672-135-0x0000000000A10000-0x0000000000EDA000-memory.dmp

Filesize
4.8MB

Download
memory/3672-136-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/3672-134-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-149-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/3744-143-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download
memory/3744-144-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-146-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/3744-147-0x0000000005400000-0x00000000059A4000-memory.dmp

Filesize
5.6MB

Download
memory/3744-148-0x00000000054D0000-0x00000000054DA000-memory.dmp

Filesize
40KB

Download
memory/3744-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3744-150-0x0000000005980000-0x000000000598A000-memory.dmp

Filesize
40KB

Download
memory/3744-151-0x0000000007840000-0x0000000007A02000-memory.dmp

Filesize
1.8MB

Download
memory/3744-152-0x0000000007F40000-0x000000000846C000-memory.dmp

Filesize
5.2MB

Download
memory/3744-153-0x00000000077D0000-0x00000000077E2000-memory.dmp

Filesize
72KB

Download
memory/3772-145-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 3672 wrote to memory of 3792	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	WScript.exe
PID 3672 wrote to memory of 3792	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	WScript.exe
PID 3672 wrote to memory of 3792	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	WScript.exe
PID 3792 wrote to memory of 3636	3792	WScript.exe	Gvkmyonftrbtmminstaller_03-19-15(2).exe
PID 3792 wrote to memory of 3636	3792	WScript.exe	Gvkmyonftrbtmminstaller_03-19-15(2).exe
PID 3792 wrote to memory of 3636	3792	WScript.exe	Gvkmyonftrbtmminstaller_03-19-15(2).exe
PID 3672 wrote to memory of 3764	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3764	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3764	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3672 wrote to memory of 3744	3672	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe	abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
PID 3636 wrote to memory of 3772	3636	Gvkmyonftrbtmminstaller_03-19-15(2).exe	Gvkmyonftrbtmminstaller_03-19-15(2).exe
PID 3636 wrote to memory of 3772	3636	Gvkmyonftrbtmminstaller_03-19-15(2).exe	Gvkmyonftrbtmminstaller_03-19-15(2).exe
PID 3636 wrote to memory of 3772	3636	Gvkmyonftrbtmminstaller_03-19-15(2).exe	Gvkmyonftrbtmminstaller_03-19-15(2).exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads