Analysis
-
max time kernel
149s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-04-2022 16:28
Static task
static1
Behavioral task
behavioral1
Sample
4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe
Resource
win7-20220414-en
General
-
Target
4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe
-
Size
515KB
-
MD5
9c2469949de87958c9a0adc0fbd642fe
-
SHA1
850f57a6b43ab16003489dc3ade010d943882209
-
SHA256
4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f
-
SHA512
474dbc99b12f10fff578ccb39cafabd5e3ec2c8599ba1e5e39227c5edc11e6338d043dd42f5fb902ca74f661fb5eda89c17e99ce27b272a857ada18a119f336f
Malware Config
Signatures
-
Poullight Stealer Payload 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe family_poullight \Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe family_poullight \Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe family_poullight \Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe family_poullight \Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe family_poullight C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe family_poullight C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe family_poullight behavioral1/memory/688-73-0x0000000000FD0000-0x0000000000FEE000-memory.dmp family_poullight -
Executes dropped EXE 2 IoCs
Processes:
RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exeRWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exepid process 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe 688 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeRWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exepid process 1836 cmd.exe 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exepid process 688 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe 688 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exedescription pid process Token: SeDebugPrivilege 688 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exeWScript.execmd.exeRWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exedescription pid process target process PID 1840 wrote to memory of 1832 1840 4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe WScript.exe PID 1840 wrote to memory of 1832 1840 4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe WScript.exe PID 1840 wrote to memory of 1832 1840 4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe WScript.exe PID 1840 wrote to memory of 1832 1840 4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe WScript.exe PID 1832 wrote to memory of 1836 1832 WScript.exe cmd.exe PID 1832 wrote to memory of 1836 1832 WScript.exe cmd.exe PID 1832 wrote to memory of 1836 1832 WScript.exe cmd.exe PID 1832 wrote to memory of 1836 1832 WScript.exe cmd.exe PID 1836 wrote to memory of 1636 1836 cmd.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe PID 1836 wrote to memory of 1636 1836 cmd.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe PID 1836 wrote to memory of 1636 1836 cmd.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe PID 1836 wrote to memory of 1636 1836 cmd.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe PID 1636 wrote to memory of 688 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe PID 1636 wrote to memory of 688 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe PID 1636 wrote to memory of 688 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe PID 1636 wrote to memory of 688 1636 RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe"C:\Users\Admin\AppData\Local\Temp\4debb4f25eac92ef1ee8fcb387080dbd72f825e266aa6b2d4e0c5302d512cb3f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bat.bat3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exeRWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exe -pRWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe -dC:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe"C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exeFilesize
97KB
MD52995b91e9b88499e68ec3c861fe3b1b2
SHA181e1dd982bd944959f885abb60fbb7dd4ad32211
SHA2569bbe54eb278a7a8478a6ecc8697f91ad043a08fd2f57e2c6a7ccc953ed10ea89
SHA512174043125f88fe0fca588017e043b3c633ae721ba571fbacf3dceeef3646fe1ebbe66c2c84130029071d63621b8635381eb0e81cb8ee980f34c872e4a49cd904
-
C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exeFilesize
97KB
MD52995b91e9b88499e68ec3c861fe3b1b2
SHA181e1dd982bd944959f885abb60fbb7dd4ad32211
SHA2569bbe54eb278a7a8478a6ecc8697f91ad043a08fd2f57e2c6a7ccc953ed10ea89
SHA512174043125f88fe0fca588017e043b3c633ae721ba571fbacf3dceeef3646fe1ebbe66c2c84130029071d63621b8635381eb0e81cb8ee980f34c872e4a49cd904
-
C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exeFilesize
352KB
MD5af2333f5e5f0b52e276520cf2c2a37dc
SHA13573e7c2b06802c2970a3a15028ef163aba0545a
SHA25614b7db0bf2139f1e211c673763763c60ad9f220d591a9ddbdb13f5ca7f70c6d9
SHA512e3e31111295d99523038271b50c8ae30cf080a0204a1cc5cd2288b243c5bf2d7466234fa34bb0e0dc5f75684ca644f17613887db53918d209a28d136fb95c17b
-
C:\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exeFilesize
352KB
MD5af2333f5e5f0b52e276520cf2c2a37dc
SHA13573e7c2b06802c2970a3a15028ef163aba0545a
SHA25614b7db0bf2139f1e211c673763763c60ad9f220d591a9ddbdb13f5ca7f70c6d9
SHA512e3e31111295d99523038271b50c8ae30cf080a0204a1cc5cd2288b243c5bf2d7466234fa34bb0e0dc5f75684ca644f17613887db53918d209a28d136fb95c17b
-
C:\Users\Admin\AppData\Local\Temp\bat.batFilesize
125B
MD55361126438d05693d90a1a9882ef1b0f
SHA1931a327a145a8bd9778dd41c7ec67158d1b0b29f
SHA256236f4cdf7fcb64f442c936e2d03e6e71c4a713107012dc66ab46163a7648f46e
SHA512ca069cd3739a6310e08813820f8c744248774106e744bb28ee04fd062fd8daacc75cc244abc2c4bb045a995ad223710db23211c4faa70c30e31e0ae2d4659881
-
C:\Users\Admin\AppData\Local\Temp\vbs.vbsFilesize
89B
MD5dc06d3c7415f4f6b05272426a63e9fd1
SHA12a148ec726cde2a19222c03ebf2cf48e8a5c171f
SHA256101467d0422de2fafce3dc4e7f28343f7eab7f132a42843a9498b0fe3ffa9093
SHA512d2063eddd861715db497adaf3440fc120aed019aa309ca2010d7b19e26987648c67f590e141df31b7c660cfebb33f052861fa2d1db5017e5f97dd4437155f76a
-
\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exeFilesize
97KB
MD52995b91e9b88499e68ec3c861fe3b1b2
SHA181e1dd982bd944959f885abb60fbb7dd4ad32211
SHA2569bbe54eb278a7a8478a6ecc8697f91ad043a08fd2f57e2c6a7ccc953ed10ea89
SHA512174043125f88fe0fca588017e043b3c633ae721ba571fbacf3dceeef3646fe1ebbe66c2c84130029071d63621b8635381eb0e81cb8ee980f34c872e4a49cd904
-
\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exeFilesize
97KB
MD52995b91e9b88499e68ec3c861fe3b1b2
SHA181e1dd982bd944959f885abb60fbb7dd4ad32211
SHA2569bbe54eb278a7a8478a6ecc8697f91ad043a08fd2f57e2c6a7ccc953ed10ea89
SHA512174043125f88fe0fca588017e043b3c633ae721ba571fbacf3dceeef3646fe1ebbe66c2c84130029071d63621b8635381eb0e81cb8ee980f34c872e4a49cd904
-
\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exeFilesize
97KB
MD52995b91e9b88499e68ec3c861fe3b1b2
SHA181e1dd982bd944959f885abb60fbb7dd4ad32211
SHA2569bbe54eb278a7a8478a6ecc8697f91ad043a08fd2f57e2c6a7ccc953ed10ea89
SHA512174043125f88fe0fca588017e043b3c633ae721ba571fbacf3dceeef3646fe1ebbe66c2c84130029071d63621b8635381eb0e81cb8ee980f34c872e4a49cd904
-
\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exeFilesize
97KB
MD52995b91e9b88499e68ec3c861fe3b1b2
SHA181e1dd982bd944959f885abb60fbb7dd4ad32211
SHA2569bbe54eb278a7a8478a6ecc8697f91ad043a08fd2f57e2c6a7ccc953ed10ea89
SHA512174043125f88fe0fca588017e043b3c633ae721ba571fbacf3dceeef3646fe1ebbe66c2c84130029071d63621b8635381eb0e81cb8ee980f34c872e4a49cd904
-
\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.exeFilesize
97KB
MD52995b91e9b88499e68ec3c861fe3b1b2
SHA181e1dd982bd944959f885abb60fbb7dd4ad32211
SHA2569bbe54eb278a7a8478a6ecc8697f91ad043a08fd2f57e2c6a7ccc953ed10ea89
SHA512174043125f88fe0fca588017e043b3c633ae721ba571fbacf3dceeef3646fe1ebbe66c2c84130029071d63621b8635381eb0e81cb8ee980f34c872e4a49cd904
-
\Users\Admin\AppData\Local\Temp\RWHhwGrHjYioGerpGoGOFKREgGGHoPgteRH2wREWHPhre.sfx.exeFilesize
352KB
MD5af2333f5e5f0b52e276520cf2c2a37dc
SHA13573e7c2b06802c2970a3a15028ef163aba0545a
SHA25614b7db0bf2139f1e211c673763763c60ad9f220d591a9ddbdb13f5ca7f70c6d9
SHA512e3e31111295d99523038271b50c8ae30cf080a0204a1cc5cd2288b243c5bf2d7466234fa34bb0e0dc5f75684ca644f17613887db53918d209a28d136fb95c17b
-
memory/688-70-0x0000000000000000-mapping.dmp
-
memory/688-73-0x0000000000FD0000-0x0000000000FEE000-memory.dmpFilesize
120KB
-
memory/688-74-0x000000001B080000-0x000000001B082000-memory.dmpFilesize
8KB
-
memory/1636-62-0x0000000000000000-mapping.dmp
-
memory/1832-55-0x0000000000000000-mapping.dmp
-
memory/1836-58-0x0000000000000000-mapping.dmp
-
memory/1840-54-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB