poullight | 13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51

General

Target

13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe
Size

9.8MB
MD5

cb51ae996b700ee7bdea174e68be0d1f
SHA1

51b4827138e91bbc786e18c2cf8359fce208f23e
SHA256

13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51
SHA512

4ecaab37da9352c9264b68cd0b9ca0392b6ec7cbc1017e703ed139285c5f1ef499f56a64ccc0543fb00769201c406226d2cce4074e56f70d31ee33cd71d0117a

Score

10^/10

poullight spyware stealer trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/916-57-0x000000000CAF0000-0x000000000D49A000-memory.dmp	family_poullight
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe	family_poullight
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe	family_poullight
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe	family_poullight
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe	family_poullight
behavioral1/memory/1680-63-0x0000000000A40000-0x0000000000A5E000-memory.dmp	family_poullight

Executes dropped EXE 1 IoCs

Processes:

oHm.exe

pid process

1680 oHm.exe

pid	process
1680	oHm.exe

Loads dropped DLL 2 IoCs

Processes:

13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe

pid	process
916	13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe
916	13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

oHm.exe

pid process

1680 oHm.exe
1680 oHm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

oHm.exe

description pid process

Token: SeDebugPrivilege 1680 oHm.exe

pid	process
1680	oHm.exe
1680	oHm.exe

description	pid	process
Token: SeDebugPrivilege	1680	oHm.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe

description	pid	process	target process
PID 916 wrote to memory of 1680	916	13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe	oHm.exe
PID 916 wrote to memory of 1680	916	13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe	oHm.exe
PID 916 wrote to memory of 1680	916	13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe	oHm.exe
PID 916 wrote to memory of 1680	916	13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe	oHm.exe

C:\Users\Admin\AppData\Local\Temp\13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe
"C:\Users\Admin\AppData\Local\Temp\13add5fa2b81c97862ea5002568442252dd0fbd4159228ed48b41704b4288b51.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe
Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe
Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe
Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\oHm.exe
Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
memory/916-54-0x0000000006EB0000-0x000000000786C000-memory.dmp

Filesize
9.7MB

Download
memory/916-55-0x0000000007870000-0x000000000822C000-memory.dmp

Filesize
9.7MB

Download
memory/916-56-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/916-57-0x000000000CAF0000-0x000000000D49A000-memory.dmp

Filesize
9.7MB

Download
memory/1680-60-0x0000000000000000-mapping.dmp

Download
memory/1680-63-0x0000000000A40000-0x0000000000A5E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads