poullight | 6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81

General

Target

6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe
Size

5.4MB
MD5

1d68e030480a91f06de241d9118741e9
SHA1

d129d9a59b9adad44e18fcd1d42348de85c6153f
SHA256

6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81
SHA512

1d59b70b905b1f8a2b05e687afa980e84d485ac414e7932d80cbedc49b8c727cf2c3b21562e3feae94b5f0fbabf8bc5581e4592fcf5f4432b1217051d072303b

Score

10^/10

poullight spyware stealer trojan vmprotect

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/3316-130-0x0000000000400000-0x0000000000CED000-memory.dmp	vmprotect
behavioral2/memory/3316-131-0x0000000000400000-0x0000000000CED000-memory.dmp	vmprotect
behavioral2/memory/3316-139-0x0000000000400000-0x0000000000CED000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe

pid process

3316 6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe

pid	process
3316	6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe
3316	6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe
3316	6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe
3316	6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe
3316	6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe
3316	6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe

description pid process

Token: SeDebugPrivilege 3316 6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe

description	pid	process
Token: SeDebugPrivilege	3316	6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe

C:\Users\Admin\AppData\Local\Temp\6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe
"C:\Users\Admin\AppData\Local\Temp\6c1f750d130b1d1a7712b3b7f3611e93d4aacf9eba11040193d2510ffcdfae81.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3316-130-0x0000000000400000-0x0000000000CED000-memory.dmp

Filesize
8.9MB

Download
memory/3316-131-0x0000000000400000-0x0000000000CED000-memory.dmp

Filesize
8.9MB

Download
memory/3316-135-0x0000000005850000-0x0000000005DF4000-memory.dmp

Filesize
5.6MB

Download
memory/3316-136-0x0000000005700000-0x0000000005792000-memory.dmp

Filesize
584KB

Download
memory/3316-137-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/3316-138-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/3316-139-0x0000000000400000-0x0000000000CED000-memory.dmp

Filesize
8.9MB

Download
memory/3316-140-0x00000000077C0000-0x0000000007982000-memory.dmp

Filesize
1.8MB

Download
memory/3316-141-0x00000000079A0000-0x0000000007ECC000-memory.dmp

Filesize
5.2MB

Download
memory/3316-142-0x0000000008010000-0x000000000801A000-memory.dmp

Filesize
40KB

Download
memory/3316-143-0x0000000008020000-0x0000000008032000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing