povertystealer | 0fc0f1ac42dc622c9a9000675f5437b756e6b545cb1e9309b36c85b2b85787ce

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 07:24

Target

file.exe
Size

252KB
MD5

c58dd03a9e70b6bea761131f3a7081cf
SHA1

2356af49232aaaada14ea95908cb9e6586f0631e
SHA256

0fc0f1ac42dc622c9a9000675f5437b756e6b545cb1e9309b36c85b2b85787ce
SHA512

e4114478782200d62d2073b6e34d62a977dcc45bcc005f01b47a11d3298e64ef3e81a2a35621494c8d222c1dbcb7cf7348baf412aeb6e51377fd65c028b5908f
SSDEEP

6144:HU4ZBHgMC0qOB8TrlGUuml4AOKcmIPMSBzuVU3S:HdZBHgMi4wCwIrzAU3S

Score

10^/10

Detect Poverty Stealer Payload 8 IoCs

resource	yara_rule
behavioral2/memory/3992-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/3992-2-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/3992-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/3992-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/3992-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/3992-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/3992-12-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/3992-13-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4024 set thread context of 3992	4024	file.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	4024	WerFault.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86
PID 4024 wrote to memory of 3992	4024	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 252
  2⤵
  - Program crash
  PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4024 -ip 4024
1⤵
PID:2216

memory/3992-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3992-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3992-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3992-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3992-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3992-9-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download
memory/3992-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3992-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3992-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download