Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 15:59
Static task
static1
Behavioral task
behavioral1
Sample
7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe
-
Size
1.1MB
-
MD5
e4293a4f30cb5abb7641a4c81c9a0fe2
-
SHA1
f671aac7356f14824b57927d92004ca13b8d9375
-
SHA256
7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7
-
SHA512
89f684457020aafb9747fe3c23f02fa2319469197774552f1316b5940f4c3e63fea6ffc7fc69de7c7cc6142557e8a47ec7dc628a4e72bba68336c1ced03861f3
Malware Config
Signatures
-
Poullight Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-55-0x0000000000EC0000-0x0000000001244000-memory.dmp family_poullight -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exepid process 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exepid process 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exedescription pid process Token: SeDebugPrivilege 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exepid process 2028 7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe"C:\Users\Admin\AppData\Local\Temp\7b7f9e05c1d45c83b7dbca44f52f72adeb05c0c08dde4971478a337293a639d7.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2028