povertystealer | 9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caae

General

Target

NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe
Size

252KB
MD5

a201f27403498536139e57ef617b0f9b
SHA1

4cba22ab7e3d9a5cd10355a1f4a81d047df04382
SHA256

9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caae
SHA512

64b339ce4cfeb54983cd4319d3de25498670beb0fa44ec5269ac30392cd5d87f93468a6661795f18b6884917398c73339f5af8739ea22bb7f99cefc403cfb9d4
SSDEEP

6144:m87rvJO8MKEpAmIQVdGKKmy4AO0mIgLJq2SXS:merhO8MF+m1RI5XS

Score

10^/10

Malware Config

Signatures

Detect Poverty Stealer Payload 5 IoCs

resource	yara_rule
behavioral1/memory/280-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/280-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/280-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/280-8-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/280-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3008	2472	WerFault.exe	27
1080	280	WerFault.exe	28

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 280	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	28
PID 2472 wrote to memory of 3008	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	29
PID 2472 wrote to memory of 3008	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	29
PID 2472 wrote to memory of 3008	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	29
PID 2472 wrote to memory of 3008	2472	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	29
PID 280 wrote to memory of 1080	280	AppLaunch.exe	30
PID 280 wrote to memory of 1080	280	AppLaunch.exe	30
PID 280 wrote to memory of 1080	280	AppLaunch.exe	30
PID 280 wrote to memory of 1080	280	AppLaunch.exe	30
PID 280 wrote to memory of 1080	280	AppLaunch.exe	30
PID 280 wrote to memory of 1080	280	AppLaunch.exe	30
PID 280 wrote to memory of 1080	280	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 196
    3⤵
    - Program crash
    PID:1080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 72
  2⤵
  - Program crash
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/280-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/280-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/280-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/280-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/280-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/280-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/280-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/280-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads