Overview

overview

10

Static

static

34cc348b9f...d1.exe

windows7_x64

10

34cc348b9f...d1.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    163s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 17:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1.exe

  • Size

    1.1MB

  • MD5

    06e5c0fde2cd7ee930b1049831cf8da8

  • SHA1

    fa2350fc18cdf1f934bb8fc625578c6c38e33728

  • SHA256

    34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1

  • SHA512

    751868ec358664e3b167b6c48daae7b1682cc67c944adea8d1d825520877eeafa8feeefb09d7f21760f00b7073d7606bd9fcbd305d9c06f99df988802a354323

Score
10/10
poullightspywarestealertrojan

Malware Config

Signatures

  • Poullight

    Poullight is an information stealer first seen in March 2020.

    trojanstealerpoullight
  • Poullight Stealer Payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1.exe
    "C:\Users\Admin\AppData\Local\Temp\34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:864

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/864-130-0x0000000000270000-0x00000000005F2000-memory.dmp
    Filesize

    3.5MB

    Download
  • memory/864-131-0x0000000005C40000-0x00000000061E4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/864-132-0x0000000005790000-0x0000000005822000-memory.dmp
    Filesize

    584KB

    Download
  • memory/864-133-0x0000000005750000-0x000000000575A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/864-134-0x00000000058A0000-0x0000000005906000-memory.dmp
    Filesize

    408KB

    Download
  • memory/864-135-0x0000000005BF0000-0x0000000005BFA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/864-136-0x00000000079B0000-0x0000000007B72000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/864-137-0x00000000080B0000-0x00000000085DC000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/864-138-0x0000000007940000-0x0000000007952000-memory.dmp
    Filesize

    72KB

    Download