poullight | 927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd

General

Target

927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe
Size

3.0MB
MD5

4e1ae916a283ff087b4daf71f73540cf
SHA1

c9f8cb325b0dc69638984060c100604bf61cf0fd
SHA256

927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd
SHA512

87abe3370506db994bf456ff008905690f6fd7cbb10440a8fba17a1fbec13ed14a91f2466b8e2bec4ac36b8397655866871646ffdcf1ff30f973b8288c8abbf6

Score

10^/10

poullight spyware stealer suricata trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 5 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\build.exe	family_poullight
\Users\Admin\AppData\Local\Temp\build.exe	family_poullight
C:\Users\Admin\AppData\Local\Temp\build.exe	family_poullight
C:\Users\Admin\AppData\Local\Temp\build.exe	family_poullight
behavioral1/memory/752-64-0x0000000000BC0000-0x0000000000BE0000-memory.dmp	family_poullight

suricata: ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php
suricata: ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata
Executes dropped EXE 2 IoCs

Processes:

build.exeHB.exe

pid process

752 build.exe
1692 HB.exe

pid	process
752	build.exe
1692	HB.exe

Loads dropped DLL 3 IoCs

Processes:

927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe

pid	process
1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe
1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe
1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1941E61-DBC2-11EC-A5C5-C6DEEDF3EE1E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e69285cf6fd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "360203932"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c0000000002000000000010660000000100002000000026f6a36edac15702ace0f16c54747b5999edd1cc84ca6c7e3edf747e088ead48000000000e800000000200002000000027e01e90db5e183f7e55c447944dcddb729680d18a288aad2c77686729d42d6d20000000a19ae22a0caa87d9649fe70c246a22d3a70d95f5c5c9bb1b940e202ccc594fa8400000008fdd0034eb684df9b37d7c38c6c634e37d256cab1fd16e7ff72672697053c4500553993c649458fe6b7e2c560c2c7b6ee7de9ecb2dcc824710a58392aee84e4b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000002449bdf1180aa049d9c5a5e2be3bb4408dd954802abb8db2a4ed668b5a1bb160000000000e80000000020000200000005cfc944f4264086977ca66c49cc2bf5799dc5d912e406ecb875fb3a62bdf23519000000087dc1250f2e97c92150c1c8c8734925aacefca62ba863b02d4568af949ef7b01a8696ffb7d27122512b1cda90ea8f7a435604af606a53fb1e60bdb81aa98f372b2c25669da1a9ba5bc06bce03fc9fe84df09b7a9e4b862d47ec9a340db4650a546794562eab610b0b8b964bc9f5a514e5ad43db31bce590d8f05bc67278b96f2e973809579aa76db148d2accbfb759a5400000008bacb04735cf47e0f46b30b5cf72af267c8dd342aee9d0e04be7e331a89c884da268a9ae21324e181d1e6905ecd8cd957ae6941c3a578c19bdba51ab3240d070	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

build.exe

pid process

752 build.exe
752 build.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

build.exe

description pid process

Token: SeDebugPrivilege 752 build.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1872 iexplore.exe
Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

HB.exeiexplore.exeIEXPLORE.EXE

pid process

1692 HB.exe
1692 HB.exe
1872 iexplore.exe
1872 iexplore.exe
848 IEXPLORE.EXE
848 IEXPLORE.EXE
1692 HB.exe
1692 HB.exe
848 IEXPLORE.EXE
848 IEXPLORE.EXE

pid	process
752	build.exe
752	build.exe

description	pid	process
Token: SeDebugPrivilege	752	build.exe

pid	process
1872	iexplore.exe

pid	process
1692	HB.exe
1692	HB.exe
1872	iexplore.exe
1872	iexplore.exe
848	IEXPLORE.EXE
848	IEXPLORE.EXE
1692	HB.exe
1692	HB.exe
848	IEXPLORE.EXE
848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exeHB.exeiexplore.exe

description	pid	process	target process
PID 1472 wrote to memory of 752	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	build.exe
PID 1472 wrote to memory of 752	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	build.exe
PID 1472 wrote to memory of 752	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	build.exe
PID 1472 wrote to memory of 752	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	build.exe
PID 1472 wrote to memory of 1692	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	HB.exe
PID 1472 wrote to memory of 1692	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	HB.exe
PID 1472 wrote to memory of 1692	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	HB.exe
PID 1472 wrote to memory of 1692	1472	927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe	HB.exe
PID 1692 wrote to memory of 1872	1692	HB.exe	iexplore.exe
PID 1692 wrote to memory of 1872	1692	HB.exe	iexplore.exe
PID 1692 wrote to memory of 1872	1692	HB.exe	iexplore.exe
PID 1692 wrote to memory of 1872	1692	HB.exe	iexplore.exe
PID 1872 wrote to memory of 848	1872	iexplore.exe	IEXPLORE.EXE
PID 1872 wrote to memory of 848	1872	iexplore.exe	IEXPLORE.EXE
PID 1872 wrote to memory of 848	1872	iexplore.exe	IEXPLORE.EXE
PID 1872 wrote to memory of 848	1872	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe
"C:\Users\Admin\AppData\Local\Temp\927571741d81bafe08ebd1c074c810d9ccf55c624133c9ebc3d285d0d804c0fd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Users\Admin\AppData\Local\Temp\HB.exe
"C:\Users\Admin\AppData\Local\Temp\HB.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://jq.qq.com/?_wv=1027&k=57Cts1S
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
28760896f27c772bc1757c64a23570ef

SHA1
9398846101319958d9ab3620b6743a637581322b

SHA256
178d98d6b971b77785cc4ea2969088c8f7e40e8df1fb93050c4af10bf76041bb

SHA512
46ddaabc43cbbeb9c2bea619c451b1c6b3217b5e74055226d96fbf9801b23476fbbb7fe6a202adf3472bfefd7804861126dcbef108ba245b8899a08e77b7bf22

Download Submit
C:\Users\Admin\AppData\Local\Temp\HB.exe
Filesize
2.8MB

MD5
3f9dd912d6f833970e34e99ac80ae8f0

SHA1
38cbef846a4d67728c1e90ae91ffb7eb6d4d9442

SHA256
9595db47c8f460cdd27b9a4c1b1ac68acdda489ccf867d9495883519950d3ef6

SHA512
cfdf38bdaacaf396f6e76792f956305da1d5a48b50ae7d4f1113a72ab957e61b320360dbde208613e651ad5f1ea900b6a3140440a6a59e7f11117647954ba938

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
100KB

MD5
129bbd25c68f6dfd3cd3ea812314e848

SHA1
5230aad2e3839fbd196d2ac4f7ff2201c38a5d7a

SHA256
f844fbb742d6fbc2081c7c3e32f4bae2e6b4bdb6224bbe8a34908a111f86542e

SHA512
f01b1ba6b925a6945a9f7d0437afaf31b713474ad70257f9415a83753e92d93ac61832e7b52ff6876c1969402b8601fde0cc5f428efe28ea53155f171e2d4973

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
100KB

MD5
129bbd25c68f6dfd3cd3ea812314e848

SHA1
5230aad2e3839fbd196d2ac4f7ff2201c38a5d7a

SHA256
f844fbb742d6fbc2081c7c3e32f4bae2e6b4bdb6224bbe8a34908a111f86542e

SHA512
f01b1ba6b925a6945a9f7d0437afaf31b713474ad70257f9415a83753e92d93ac61832e7b52ff6876c1969402b8601fde0cc5f428efe28ea53155f171e2d4973

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QQMIE4X9.txt
Filesize
608B

MD5
8d41c92c3f2cb4778fd1431e6e8386b4

SHA1
3832e4ed88eb74ce76d162b65adf309f8ec02b5e

SHA256
82b52fb2e14d0af874fc8be1cbcd3cf27631cab2207f690be97ad5541feb7b01

SHA512
dd836f75c479cc4c26a020740b389968944ce862afbccfd91aa3b19c916e603fde74052993422212772f285e296345e4a628c45002b3e9f04240153dd1330374

Download Submit
\Users\Admin\AppData\Local\Temp\HB.exe
Filesize
2.8MB

MD5
3f9dd912d6f833970e34e99ac80ae8f0

SHA1
38cbef846a4d67728c1e90ae91ffb7eb6d4d9442

SHA256
9595db47c8f460cdd27b9a4c1b1ac68acdda489ccf867d9495883519950d3ef6

SHA512
cfdf38bdaacaf396f6e76792f956305da1d5a48b50ae7d4f1113a72ab957e61b320360dbde208613e651ad5f1ea900b6a3140440a6a59e7f11117647954ba938

Download Submit
\Users\Admin\AppData\Local\Temp\build.exe
Filesize
100KB

MD5
129bbd25c68f6dfd3cd3ea812314e848

SHA1
5230aad2e3839fbd196d2ac4f7ff2201c38a5d7a

SHA256
f844fbb742d6fbc2081c7c3e32f4bae2e6b4bdb6224bbe8a34908a111f86542e

SHA512
f01b1ba6b925a6945a9f7d0437afaf31b713474ad70257f9415a83753e92d93ac61832e7b52ff6876c1969402b8601fde0cc5f428efe28ea53155f171e2d4973

Download Submit
\Users\Admin\AppData\Local\Temp\build.exe
Filesize
100KB

MD5
129bbd25c68f6dfd3cd3ea812314e848

SHA1
5230aad2e3839fbd196d2ac4f7ff2201c38a5d7a

SHA256
f844fbb742d6fbc2081c7c3e32f4bae2e6b4bdb6224bbe8a34908a111f86542e

SHA512
f01b1ba6b925a6945a9f7d0437afaf31b713474ad70257f9415a83753e92d93ac61832e7b52ff6876c1969402b8601fde0cc5f428efe28ea53155f171e2d4973

Download Submit
memory/752-64-0x0000000000BC0000-0x0000000000BE0000-memory.dmp

Filesize
128KB

Download
memory/752-57-0x0000000000000000-mapping.dmp

Download
memory/1472-54-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/1692-61-0x0000000000000000-mapping.dmp

Download
memory/1692-65-0x00000000020A0000-0x00000000021AD000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads