metastealer | bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4

General

Target

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe
Size

157KB
MD5

7fa498515cf1faf0c32b02b0ec532a13
SHA1

474e7c532be9af3c5fdd297982253f4454102305
SHA256

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4
SHA512

bdbedd153628f9d3ac82f5df90372e19e7f39847b09c72bfaff227b044c86769df78022e616b20413c0cf080a87c08b697edb9593f8ced55b48a1c3409d7ed48

Score

10^/10

Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer
Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2460-133-0x0000000000400000-0x0000000000420000-memory.dmp	family_poullight

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe

description	pid	process	target process
PID 1808 set thread context of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2460 AppLaunch.exe
2460 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2460 AppLaunch.exe

pid	process
2460	AppLaunch.exe
2460	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2460	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe

description	pid	process	target process
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe
PID 1808 wrote to memory of 2460	1808	bd2719ed2beca9689bbc1f23836c1501613067d223c0f254c742d2162a5e0af4.exe	AppLaunch.exe

memory/1808-130-0x00000000009E0000-0x0000000000A0E000-memory.dmp

Filesize
184KB

Download
memory/1808-131-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download
memory/2460-132-0x0000000000000000-mapping.dmp

Download
memory/2460-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2460-134-0x00000000057B0000-0x0000000005D54000-memory.dmp

Filesize
5.6MB

Download
memory/2460-135-0x00000000052A0000-0x0000000005332000-memory.dmp

Filesize
584KB

Download
memory/2460-136-0x0000000005290000-0x000000000529A000-memory.dmp

Filesize
40KB

Download
memory/2460-137-0x00000000054D0000-0x0000000005536000-memory.dmp

Filesize
408KB

Download
memory/2460-138-0x0000000006260000-0x000000000626A000-memory.dmp

Filesize
40KB

Download
memory/2460-139-0x0000000005200000-0x00000000057A4000-memory.dmp

Filesize
5.6MB

Download
memory/2460-140-0x00000000074D0000-0x0000000007692000-memory.dmp

Filesize
1.8MB

Download
memory/2460-141-0x0000000007BD0000-0x00000000080FC000-memory.dmp

Filesize
5.2MB

Download
memory/2460-142-0x0000000007460000-0x0000000007472000-memory.dmp

Filesize
72KB

Download