poullight | bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4

General

Target

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe
Size

157KB
MD5

7fa498515cf1faf0c32b02b0ec532a13
SHA1

474e7c532be9af3c5fdd297982253f4454102305
SHA256

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4
SHA512

bdbedd153628f9d3ac82f5df90372e19e7f39847b09c72bfaff227b044c86769df78022e616b20413c0cf080a87c08b697edb9593f8ced55b48a1c3409d7ed48

Score

10^/10

poullight stealer trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1204-61-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1204-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1204-63-0x000000000041A94E-mapping.dmp	family_poullight
behavioral1/memory/1204-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1204-65-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight
behavioral1/memory/1204-67-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe

description	pid	process	target process
PID 844 set thread context of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exeAppLaunch.exe

pid process

844 bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe
1204 AppLaunch.exe
1204 AppLaunch.exe

pid	process
844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe
1204	AppLaunch.exe
1204	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe
Token: SeDebugPrivilege	1204	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe

description	pid	process	target process
PID 844 wrote to memory of 1800	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1800	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1800	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1800	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1800	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1800	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1800	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 844 wrote to memory of 1204	844	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe
"C:\Users\Admin\AppData\Local\Temp\bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-54-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/844-55-0x0000000076431000-0x0000000076433000-memory.dmp

Filesize
8KB

Download
memory/844-56-0x0000000000300000-0x0000000000314000-memory.dmp

Filesize
80KB

Download
memory/1204-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-63-0x000000000041A94E-mapping.dmp

Download
memory/1204-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-69-0x00000000024D5000-0x00000000024E6000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads