Analysis
-
max time kernel
155s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
12-03-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
Resource
win7-20220311-en
General
-
Target
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe
-
Size
4.8MB
-
MD5
45f8507e73bdce9b9e1467709d29d5b0
-
SHA1
bc96a4350d48c08b08207c82d14ff2392f24aa8e
-
SHA256
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186
-
SHA512
2b05dea1ff7ba6ce3c62519f606943c962c496e189f6c69353f07549f1b3d4a0c3ef9517cc7248061fef692628d632e734594fe906739078b89868e7a9cb4e3a
Malware Config
Signatures
-
Poullight Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3744-140-0x0000000000400000-0x0000000000420000-memory.dmp family_poullight -
Executes dropped EXE 2 IoCs
Processes:
Gvkmyonftrbtmminstaller_03-19-15(2).exeGvkmyonftrbtmminstaller_03-19-15(2).exepid process 3636 Gvkmyonftrbtmminstaller_03-19-15(2).exe 3772 Gvkmyonftrbtmminstaller_03-19-15(2).exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe upx C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe upx C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeWScript.exeGvkmyonftrbtmminstaller_03-19-15(2).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation Gvkmyonftrbtmminstaller_03-19-15(2).exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exedescription pid process target process PID 3672 set thread context of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeabe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exepid process 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe 3744 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe 3744 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeabe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exedescription pid process Token: SeDebugPrivilege 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe Token: SeDebugPrivilege 3744 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Gvkmyonftrbtmminstaller_03-19-15(2).exeGvkmyonftrbtmminstaller_03-19-15(2).exepid process 3636 Gvkmyonftrbtmminstaller_03-19-15(2).exe 3772 Gvkmyonftrbtmminstaller_03-19-15(2).exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeWScript.exeGvkmyonftrbtmminstaller_03-19-15(2).exedescription pid process target process PID 3672 wrote to memory of 3792 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe WScript.exe PID 3672 wrote to memory of 3792 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe WScript.exe PID 3672 wrote to memory of 3792 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe WScript.exe PID 3792 wrote to memory of 3636 3792 WScript.exe Gvkmyonftrbtmminstaller_03-19-15(2).exe PID 3792 wrote to memory of 3636 3792 WScript.exe Gvkmyonftrbtmminstaller_03-19-15(2).exe PID 3792 wrote to memory of 3636 3792 WScript.exe Gvkmyonftrbtmminstaller_03-19-15(2).exe PID 3672 wrote to memory of 3764 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3764 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3764 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3672 wrote to memory of 3744 3672 abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe PID 3636 wrote to memory of 3772 3636 Gvkmyonftrbtmminstaller_03-19-15(2).exe Gvkmyonftrbtmminstaller_03-19-15(2).exe PID 3636 wrote to memory of 3772 3636 Gvkmyonftrbtmminstaller_03-19-15(2).exe Gvkmyonftrbtmminstaller_03-19-15(2).exe PID 3636 wrote to memory of 3772 3636 Gvkmyonftrbtmminstaller_03-19-15(2).exe Gvkmyonftrbtmminstaller_03-19-15(2).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe"C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Qvuuikpdtgjaw.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe"C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe"C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exe" spawn4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeC:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exeC:\Users\Admin\AppData\Local\Temp\abe74eee7df3e17fffce1858c1defd482a585cfc0ad60a68fab4a21119adc186.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exeMD5
3349082f26ecd031f089a42d5a3137bc
SHA18b4b8fa4e110c92ef420cbc27cdd1cffe1bfec1b
SHA256cb15de3436bfdc7d30ccacd99d38766b7a47282e32c778437852305787f9d5c9
SHA512ef181658d49ba5aa23ac44fb7fd1f836f276be6097f8b9e1a59d0d21e53ad1a4a40f269d4a4e437c6f29c659144657e873b82ef069aa9237ac9492b9be6f892c
-
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exeMD5
3349082f26ecd031f089a42d5a3137bc
SHA18b4b8fa4e110c92ef420cbc27cdd1cffe1bfec1b
SHA256cb15de3436bfdc7d30ccacd99d38766b7a47282e32c778437852305787f9d5c9
SHA512ef181658d49ba5aa23ac44fb7fd1f836f276be6097f8b9e1a59d0d21e53ad1a4a40f269d4a4e437c6f29c659144657e873b82ef069aa9237ac9492b9be6f892c
-
C:\Users\Admin\AppData\Local\Temp\Gvkmyonftrbtmminstaller_03-19-15(2).exeMD5
3349082f26ecd031f089a42d5a3137bc
SHA18b4b8fa4e110c92ef420cbc27cdd1cffe1bfec1b
SHA256cb15de3436bfdc7d30ccacd99d38766b7a47282e32c778437852305787f9d5c9
SHA512ef181658d49ba5aa23ac44fb7fd1f836f276be6097f8b9e1a59d0d21e53ad1a4a40f269d4a4e437c6f29c659144657e873b82ef069aa9237ac9492b9be6f892c
-
C:\Users\Admin\AppData\Local\Temp\Qvuuikpdtgjaw.vbsMD5
7aeadae85f43cda4f8f498f5b8605602
SHA112c0bdf35a08ba0f79a0cbe8c1638b3eb740634b
SHA256bf2d3822304f09d5657f0241e058ca7b497d35ed6e804b3e666fd64f1f555057
SHA5126488fc5b353d3cbb49faffec6f20742a4f20f59126afe11ada2de9bcbd8bd98f5bc270e3d545b5ad835ae97f61b835b579666331058f7cba3bf2249764b3f30f
-
memory/3636-142-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/3672-135-0x0000000000A10000-0x0000000000EDA000-memory.dmpFilesize
4.8MB
-
memory/3672-136-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/3672-134-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/3744-149-0x0000000005760000-0x00000000057C6000-memory.dmpFilesize
408KB
-
memory/3744-143-0x00000000059B0000-0x0000000005F54000-memory.dmpFilesize
5.6MB
-
memory/3744-144-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/3744-146-0x00000000054E0000-0x0000000005572000-memory.dmpFilesize
584KB
-
memory/3744-147-0x0000000005400000-0x00000000059A4000-memory.dmpFilesize
5.6MB
-
memory/3744-148-0x00000000054D0000-0x00000000054DA000-memory.dmpFilesize
40KB
-
memory/3744-140-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3744-150-0x0000000005980000-0x000000000598A000-memory.dmpFilesize
40KB
-
memory/3744-151-0x0000000007840000-0x0000000007A02000-memory.dmpFilesize
1.8MB
-
memory/3744-152-0x0000000007F40000-0x000000000846C000-memory.dmpFilesize
5.2MB
-
memory/3744-153-0x00000000077D0000-0x00000000077E2000-memory.dmpFilesize
72KB
-
memory/3772-145-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB