poullight | e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c

General

Target

e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe
Size

169KB
MD5

a77881f2e21529033b3aac22a0048812
SHA1

f33e435c3eeae4e085d66cddf35b3974b534b237
SHA256

e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c
SHA512

d8448319f4f8579279055eaff010c5551f34eb9c44b563b366f0ac1f56007838651df02a83b42b3f9b2860a844750905f909633364d6b15c99785b233909f8a4

Score

10^/10

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1472-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-61-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-63-0x000000000041A94E-mapping.dmp	family_poullight
behavioral1/memory/1472-65-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1472-67-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe

description	pid	process	target process
PID 1668 set thread context of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

1472 AppLaunch.exe
1472 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1472 AppLaunch.exe

pid	process
1472	AppLaunch.exe
1472	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1472	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe

description	pid	process	target process
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe
PID 1668 wrote to memory of 1472	1668	e2dab2f3fd421cad1bd97b76afd3b63856c81dd2be3ac441e3aecb204ec3bd6c.exe	AppLaunch.exe

memory/1472-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-63-0x000000000041A94E-mapping.dmp

Download
memory/1472-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1472-69-0x0000000004BC5000-0x0000000004BD6000-memory.dmp

Filesize
68KB

Download
memory/1668-54-0x0000000000CA0000-0x0000000000CD0000-memory.dmp

Filesize
192KB

Download
memory/1668-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x0000000000310000-0x0000000000324000-memory.dmp

Filesize
80KB

Download