poullight | e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c

General

Target

e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe
Size

169KB
MD5

a77881f2e21529033b3aac22a0048812
SHA1

f33e435c3eeae4e085d66cddf35b3974b534b237
SHA256

e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c
SHA512

d8448319f4f8579279055eaff010c5551f34eb9c44b563b366f0ac1f56007838651df02a83b42b3f9b2860a844750905f909633364d6b15c99785b233909f8a4

Score

10^/10

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1472-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-61-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-63-0x000000000041A94E-mapping.dmp	family_poullight
behavioral1/memory/1472-65-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-67-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1472	AppLaunch.exe
1472	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	28

memory/1472-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-69-0x0000000004BC5000-0x0000000004BD6000-memory.dmp

Filesize
68KB

Download
memory/1668-54-0x0000000000CA0000-0x0000000000CD0000-memory.dmp

Filesize
192KB

Download
memory/1668-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x0000000000310000-0x0000000000324000-memory.dmp

Filesize
80KB

Download