povertystealer | 42baf0d9105229ca324cb979bcd9fa893bd2585cb91a98c7406ef610b1e35291

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 13:23

Target

file.exe
Size

268KB
MD5

412f2a790774bab54a808da285637606
SHA1

176df256acbaeae1d78076becaddbb9319d657ce
SHA256

42baf0d9105229ca324cb979bcd9fa893bd2585cb91a98c7406ef610b1e35291
SHA512

2e9cc7d784c02fd06487760913785c15c23988d6412aeef62ff2293c62016d3d8b60efa692f4ee31349fd36fca4481aa0861986991420d853dc7ce9b4f94b220
SSDEEP

6144:vcLzuEPl/CBpmpCdgTiemAOGCNvLz1aGGr:vszuGZC3vX4YvXw

Score

10^/10

Detect Poverty Stealer Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2380-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2380-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2380-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2380-8-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2380-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 744 set thread context of 2380	744	file.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2116	744	WerFault.exe	27
2284	2380	WerFault.exe	28

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 744 wrote to memory of 2380	744	file.exe	28
PID 2380 wrote to memory of 2284	2380	AppLaunch.exe	30
PID 2380 wrote to memory of 2284	2380	AppLaunch.exe	30
PID 2380 wrote to memory of 2284	2380	AppLaunch.exe	30
PID 2380 wrote to memory of 2284	2380	AppLaunch.exe	30
PID 2380 wrote to memory of 2284	2380	AppLaunch.exe	30
PID 2380 wrote to memory of 2284	2380	AppLaunch.exe	30
PID 2380 wrote to memory of 2284	2380	AppLaunch.exe	30
PID 744 wrote to memory of 2116	744	file.exe	29
PID 744 wrote to memory of 2116	744	file.exe	29
PID 744 wrote to memory of 2116	744	file.exe	29
PID 744 wrote to memory of 2116	744	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 196
    3⤵
    - Program crash
    PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 140
  2⤵
  - Program crash
  PID:2116

memory/2380-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2380-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2380-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2380-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2380-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2380-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2380-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2380-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2380-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download