povertystealer | 0fc0f1ac42dc622c9a9000675f5437b756e6b545cb1e9309b36c85b2b85787ce

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 07:25

Target

file.exe
Size

252KB
MD5

c58dd03a9e70b6bea761131f3a7081cf
SHA1

2356af49232aaaada14ea95908cb9e6586f0631e
SHA256

0fc0f1ac42dc622c9a9000675f5437b756e6b545cb1e9309b36c85b2b85787ce
SHA512

e4114478782200d62d2073b6e34d62a977dcc45bcc005f01b47a11d3298e64ef3e81a2a35621494c8d222c1dbcb7cf7348baf412aeb6e51377fd65c028b5908f
SSDEEP

6144:HU4ZBHgMC0qOB8TrlGUuml4AOKcmIPMSBzuVU3S:HdZBHgMi4wCwIrzAU3S

Score

10^/10

Detect Poverty Stealer Payload 9 IoCs

resource	yara_rule
behavioral2/memory/4072-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-2-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-7-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-12-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4072-13-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 4072	5056	file.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3720	5056	WerFault.exe	85

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87
PID 5056 wrote to memory of 4072	5056	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 280
  2⤵
  - Program crash
  PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5056 -ip 5056
1⤵
PID:4852

memory/4072-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-9-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/4072-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4072-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download