poullight | f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3

General

Target

f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe
Size

8.4MB
MD5

97cd76c1b4ce16f65746997299f7a6ac
SHA1

603f00ff7dcb9598e6cbe4cb27188f6b27667eec
SHA256

f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3
SHA512

0a7718dc68d7adfe4ad879cfae95c208ce3c727115ba10b737c9885ca2f2b18ee6bfbc287431a9d751a24452e7c7464620e56c46a80841384cbdc79386480bbc

Score

10^/10

poullight spyware stealer trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1304-57-0x000000000C9A0000-0x000000000D1DE000-memory.dmp	family_poullight
behavioral1/files/0x00090000000126e7-61.dat	family_poullight
behavioral1/files/0x00090000000126e7-62.dat	family_poullight
behavioral1/files/0x00090000000126e7-59.dat	family_poullight
behavioral1/files/0x00090000000126e7-58.dat	family_poullight
behavioral1/memory/1584-63-0x0000000000D40000-0x0000000000D5E000-memory.dmp	family_poullight

Executes dropped EXE 1 IoCs

pid	Process
1584	ZWf.exe

Loads dropped DLL 2 IoCs

pid	Process
1304	f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe
1304	f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1584	ZWf.exe
1584	ZWf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	ZWf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1584	1304	f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe	28
PID 1304 wrote to memory of 1584	1304	f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe	28
PID 1304 wrote to memory of 1584	1304	f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe	28
PID 1304 wrote to memory of 1584	1304	f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe	28

C:\Users\Admin\AppData\Local\Temp\f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe
"C:\Users\Admin\AppData\Local\Temp\f2e2e785915aa7ed50c91b501b876ac63c331e55ca6bfeee65e7743a8186e5a3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ZWf.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ZWf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ZWf.exe

Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ZWf.exe

Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ZWf.exe

Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ZWf.exe

Filesize
97KB

MD5
027bab0544eb91583e54a27cf967b167

SHA1
b108f8c6cbfb7c2b8b44d4b2263ceb97b1414044

SHA256
8f7ec48b5c3e52f3e09b3dc35f180a82c2b0dac269a84e7cd1f8127b8fad7ec4

SHA512
34d324375180ca81dd9710b60cd39c201fb22df54bd886310875d21c8b59f89ef0dfeea24f1233ff868848c0b9b481ab96734022d3398b4b89be863a2cbeee84

Download Submit
memory/1304-54-0x0000000006BA0000-0x00000000073F0000-memory.dmp

Filesize
8.3MB

Download
memory/1304-55-0x00000000073F0000-0x0000000007C40000-memory.dmp

Filesize
8.3MB

Download
memory/1304-56-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1304-57-0x000000000C9A0000-0x000000000D1DE000-memory.dmp

Filesize
8.2MB

Download
memory/1584-63-0x0000000000D40000-0x0000000000D5E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing