povertystealer | 0ed6a0b8cd30d1be2a7539e9634b8c94853cfc8bd52bee3c966171223b939b8d

Analysis

max time kernel
33s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2023, 19:03

Target

Microfy.exe
Size

231KB
MD5

c91247e075f4e6fca603f8338427f9c5
SHA1

0434f0e193696cdeaef270876e9f5b272331f4ca
SHA256

0ed6a0b8cd30d1be2a7539e9634b8c94853cfc8bd52bee3c966171223b939b8d
SHA512

9bb8fa9725cc673b2942471f6e944d5b7adaf2a21aed904f87fa805c5ee64623f95268a2ea928ab06a1128f81b1f7fa49e9dd40087262f436a9dce4bd5d44ebd
SSDEEP

6144:3GYiKL/yfYb5B+BO99c0s0ZVtAO0gB6FTzOE9:2Y//yfYb5BIQZVt2dTzX9

Score

10^/10

Detect Poverty Stealer Payload 9 IoCs

resource	yara_rule
behavioral1/memory/1668-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-2-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-11-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-12-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1668-13-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 1668	836	Microfy.exe	90

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90
PID 836 wrote to memory of 1668	836	Microfy.exe	90

C:\Users\Admin\AppData\Local\Temp\Microfy.exe
"C:\Users\Admin\AppData\Local\Temp\Microfy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1668

memory/1668-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-9-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1668-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download