Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 23:52
Static task
static1
Behavioral task
behavioral1
Sample
d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe
Resource
win7-20220414-en
General
-
Target
d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe
-
Size
515KB
-
MD5
44f6d2d963dc3765b4f40deb9b65a1ad
-
SHA1
6141a491d23d23240ad595fc654eab3c441e34ed
-
SHA256
d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29
-
SHA512
a0bfa528f8b1853bc53bc5a8e55d1654fbb407c2dd53b30f930e82311bc2025c02fc3bdb994f5ecc478b89db47790a8a6be2398b84f5d87d0213fead4bf6f837
Malware Config
Signatures
-
Poullight Stealer Payload 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe family_poullight \Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe family_poullight \Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe family_poullight \Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe family_poullight \Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe family_poullight C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe family_poullight C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe family_poullight behavioral1/memory/1248-73-0x0000000000E20000-0x0000000000E3E000-memory.dmp family_poullight -
suricata: ET MALWARE Matrix Max Stealer Exfiltration Observed
suricata: ET MALWARE Matrix Max Stealer Exfiltration Observed
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
suricata: ET MALWARE Win32/X-Files Stealer Activity
suricata: ET MALWARE Win32/X-Files Stealer Activity
-
Executes dropped EXE 2 IoCs
Processes:
YaYaDenBerGerSOO.sfx.exeYaYaDenBerGerSOO.exepid process 1700 YaYaDenBerGerSOO.sfx.exe 1248 YaYaDenBerGerSOO.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeYaYaDenBerGerSOO.sfx.exepid process 1208 cmd.exe 1700 YaYaDenBerGerSOO.sfx.exe 1700 YaYaDenBerGerSOO.sfx.exe 1700 YaYaDenBerGerSOO.sfx.exe 1700 YaYaDenBerGerSOO.sfx.exe 1700 YaYaDenBerGerSOO.sfx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
YaYaDenBerGerSOO.exepid process 1248 YaYaDenBerGerSOO.exe 1248 YaYaDenBerGerSOO.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
YaYaDenBerGerSOO.exedescription pid process Token: SeDebugPrivilege 1248 YaYaDenBerGerSOO.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exeWScript.execmd.exeYaYaDenBerGerSOO.sfx.exedescription pid process target process PID 1828 wrote to memory of 1240 1828 d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe WScript.exe PID 1828 wrote to memory of 1240 1828 d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe WScript.exe PID 1828 wrote to memory of 1240 1828 d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe WScript.exe PID 1828 wrote to memory of 1240 1828 d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe WScript.exe PID 1240 wrote to memory of 1208 1240 WScript.exe cmd.exe PID 1240 wrote to memory of 1208 1240 WScript.exe cmd.exe PID 1240 wrote to memory of 1208 1240 WScript.exe cmd.exe PID 1240 wrote to memory of 1208 1240 WScript.exe cmd.exe PID 1208 wrote to memory of 1700 1208 cmd.exe YaYaDenBerGerSOO.sfx.exe PID 1208 wrote to memory of 1700 1208 cmd.exe YaYaDenBerGerSOO.sfx.exe PID 1208 wrote to memory of 1700 1208 cmd.exe YaYaDenBerGerSOO.sfx.exe PID 1208 wrote to memory of 1700 1208 cmd.exe YaYaDenBerGerSOO.sfx.exe PID 1700 wrote to memory of 1248 1700 YaYaDenBerGerSOO.sfx.exe YaYaDenBerGerSOO.exe PID 1700 wrote to memory of 1248 1700 YaYaDenBerGerSOO.sfx.exe YaYaDenBerGerSOO.exe PID 1700 wrote to memory of 1248 1700 YaYaDenBerGerSOO.sfx.exe YaYaDenBerGerSOO.exe PID 1700 wrote to memory of 1248 1700 YaYaDenBerGerSOO.sfx.exe YaYaDenBerGerSOO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe"C:\Users\Admin\AppData\Local\Temp\d91a59d7389e867572de42303caf07f85aa6ba13685c47fcf2f8ba1c8cde8d29.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bat.bat3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.sfx.exeYaYaDenBerGerSOO.sfx.exe -pYaYaDenBerGerSOO.exe -dC:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe"C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exeFilesize
97KB
MD558be8f739eb5b24eedce748dfc19d481
SHA1531521c7605101969c3128cbd9be285971ede508
SHA2563876d69d383cd4e2a04d497e58d1d77bc85892584186ddf0c14fe1fb83e18550
SHA512c897cbff855df56cf3aab305bbe4f5c1dcc2c0657b8cf25f0d36ae1275110452df8bb3e21b613e2db01a7b533ffcefa39c12f65cc5a283e6a0830fdb95d37715
-
C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exeFilesize
97KB
MD558be8f739eb5b24eedce748dfc19d481
SHA1531521c7605101969c3128cbd9be285971ede508
SHA2563876d69d383cd4e2a04d497e58d1d77bc85892584186ddf0c14fe1fb83e18550
SHA512c897cbff855df56cf3aab305bbe4f5c1dcc2c0657b8cf25f0d36ae1275110452df8bb3e21b613e2db01a7b533ffcefa39c12f65cc5a283e6a0830fdb95d37715
-
C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.sfx.exeFilesize
352KB
MD546a52a1778763f5aee886ffb1bc400d5
SHA19a99352b0220cc9baf16db91a07a00d0f621aa52
SHA2562ad97016ceacb17a72d2baf20ace82e9799f914ad76e011eabc6cde764f9b5d0
SHA512a4c29390fec7c045ddbff99b9ede1f26dbe6ce427ae801464612be0f5e9b3cb20355a23f58add9c682c23f405081818ae8f8220c09fcc0c23597a73222a7200f
-
C:\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.sfx.exeFilesize
352KB
MD546a52a1778763f5aee886ffb1bc400d5
SHA19a99352b0220cc9baf16db91a07a00d0f621aa52
SHA2562ad97016ceacb17a72d2baf20ace82e9799f914ad76e011eabc6cde764f9b5d0
SHA512a4c29390fec7c045ddbff99b9ede1f26dbe6ce427ae801464612be0f5e9b3cb20355a23f58add9c682c23f405081818ae8f8220c09fcc0c23597a73222a7200f
-
C:\Users\Admin\AppData\Local\Temp\bat.batFilesize
67B
MD521b435625d106bf30606091efd49dbb9
SHA14af56975b565f4365c93706c6769463c732714eb
SHA25663a81de6263ed2d6a8b6daa6d46613d22fe69f5d132279e6b2b4bb1ae77d7007
SHA5120b75cb2580f5fcb4f90f2d3ba5dcf050c5bad8d19b883c3a97070e5d78c9b6e17ce1b821aff91a09943485f06a10a19677d5580652850f3a504af647aa88e907
-
C:\Users\Admin\AppData\Local\Temp\vbs.vbsFilesize
89B
MD5dc06d3c7415f4f6b05272426a63e9fd1
SHA12a148ec726cde2a19222c03ebf2cf48e8a5c171f
SHA256101467d0422de2fafce3dc4e7f28343f7eab7f132a42843a9498b0fe3ffa9093
SHA512d2063eddd861715db497adaf3440fc120aed019aa309ca2010d7b19e26987648c67f590e141df31b7c660cfebb33f052861fa2d1db5017e5f97dd4437155f76a
-
\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exeFilesize
97KB
MD558be8f739eb5b24eedce748dfc19d481
SHA1531521c7605101969c3128cbd9be285971ede508
SHA2563876d69d383cd4e2a04d497e58d1d77bc85892584186ddf0c14fe1fb83e18550
SHA512c897cbff855df56cf3aab305bbe4f5c1dcc2c0657b8cf25f0d36ae1275110452df8bb3e21b613e2db01a7b533ffcefa39c12f65cc5a283e6a0830fdb95d37715
-
\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exeFilesize
97KB
MD558be8f739eb5b24eedce748dfc19d481
SHA1531521c7605101969c3128cbd9be285971ede508
SHA2563876d69d383cd4e2a04d497e58d1d77bc85892584186ddf0c14fe1fb83e18550
SHA512c897cbff855df56cf3aab305bbe4f5c1dcc2c0657b8cf25f0d36ae1275110452df8bb3e21b613e2db01a7b533ffcefa39c12f65cc5a283e6a0830fdb95d37715
-
\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exeFilesize
97KB
MD558be8f739eb5b24eedce748dfc19d481
SHA1531521c7605101969c3128cbd9be285971ede508
SHA2563876d69d383cd4e2a04d497e58d1d77bc85892584186ddf0c14fe1fb83e18550
SHA512c897cbff855df56cf3aab305bbe4f5c1dcc2c0657b8cf25f0d36ae1275110452df8bb3e21b613e2db01a7b533ffcefa39c12f65cc5a283e6a0830fdb95d37715
-
\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exeFilesize
97KB
MD558be8f739eb5b24eedce748dfc19d481
SHA1531521c7605101969c3128cbd9be285971ede508
SHA2563876d69d383cd4e2a04d497e58d1d77bc85892584186ddf0c14fe1fb83e18550
SHA512c897cbff855df56cf3aab305bbe4f5c1dcc2c0657b8cf25f0d36ae1275110452df8bb3e21b613e2db01a7b533ffcefa39c12f65cc5a283e6a0830fdb95d37715
-
\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.exeFilesize
97KB
MD558be8f739eb5b24eedce748dfc19d481
SHA1531521c7605101969c3128cbd9be285971ede508
SHA2563876d69d383cd4e2a04d497e58d1d77bc85892584186ddf0c14fe1fb83e18550
SHA512c897cbff855df56cf3aab305bbe4f5c1dcc2c0657b8cf25f0d36ae1275110452df8bb3e21b613e2db01a7b533ffcefa39c12f65cc5a283e6a0830fdb95d37715
-
\Users\Admin\AppData\Local\Temp\YaYaDenBerGerSOO.sfx.exeFilesize
352KB
MD546a52a1778763f5aee886ffb1bc400d5
SHA19a99352b0220cc9baf16db91a07a00d0f621aa52
SHA2562ad97016ceacb17a72d2baf20ace82e9799f914ad76e011eabc6cde764f9b5d0
SHA512a4c29390fec7c045ddbff99b9ede1f26dbe6ce427ae801464612be0f5e9b3cb20355a23f58add9c682c23f405081818ae8f8220c09fcc0c23597a73222a7200f
-
memory/1208-58-0x0000000000000000-mapping.dmp
-
memory/1240-55-0x0000000000000000-mapping.dmp
-
memory/1248-70-0x0000000000000000-mapping.dmp
-
memory/1248-73-0x0000000000E20000-0x0000000000E3E000-memory.dmpFilesize
120KB
-
memory/1700-62-0x0000000000000000-mapping.dmp
-
memory/1828-54-0x0000000075541000-0x0000000075543000-memory.dmpFilesize
8KB