povertystealer | 42baf0d9105229ca324cb979bcd9fa893bd2585cb91a98c7406ef610b1e35291

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 268KB
Sample231009-qmskdsfb53
SHA256 42baf0d9105229ca324cb979bcd9fa893bd2585cb91a98c7406ef610b1e35291
MD5 412f2a790774bab54a808da285637606
SHA1 176df256acbaeae1d78076becaddbb9319d657ce
SHA512 2e9cc7d784c02fd06487760913785c15c23988d6412aeef62ff2293c62016d3d8b60efa692f4ee31349fd36fca4481aa0861986991420d853dc7ce9b4f94b220
SSDEEP 6144:vcLzuEPl/CBpmpCdgTiemAOGCNvLz1aGGr:vszuGZC3vX4YvXw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

povertystealer stealer

Malware Config

Signatures

Detect Poverty Stealer Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2572-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2572-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2572-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2572-8-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2572-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 2572	2252	file.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2848	2252	WerFault.exe	27
1396	2572	WerFault.exe	28

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2572	2252	file.exe	28
PID 2252 wrote to memory of 2848	2252	file.exe	29
PID 2252 wrote to memory of 2848	2252	file.exe	29
PID 2252 wrote to memory of 2848	2252	file.exe	29
PID 2252 wrote to memory of 2848	2252	file.exe	29
PID 2572 wrote to memory of 1396	2572	AppLaunch.exe	30
PID 2572 wrote to memory of 1396	2572	AppLaunch.exe	30
PID 2572 wrote to memory of 1396	2572	AppLaunch.exe	30
PID 2572 wrote to memory of 1396	2572	AppLaunch.exe	30
PID 2572 wrote to memory of 1396	2572	AppLaunch.exe	30
PID 2572 wrote to memory of 1396	2572	AppLaunch.exe	30
PID 2572 wrote to memory of 1396	2572	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 196
    3⤵
    - Program crash
    PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 140
  2⤵
  - Program crash
  PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2572-1-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2572-2-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2572-3-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2572-4-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2572-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2572-6-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2572-8-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2572-10-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads