povertystealer | 9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caae

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2023 15:45

Target

NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe
Size

252KB
MD5

a201f27403498536139e57ef617b0f9b
SHA1

4cba22ab7e3d9a5cd10355a1f4a81d047df04382
SHA256

9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caae
SHA512

64b339ce4cfeb54983cd4319d3de25498670beb0fa44ec5269ac30392cd5d87f93468a6661795f18b6884917398c73339f5af8739ea22bb7f99cefc403cfb9d4
SSDEEP

6144:m87rvJO8MKEpAmIQVdGKKmy4AO0mIgLJq2SXS:merhO8MF+m1RI5XS

Score

10^/10

Detect Poverty Stealer Payload 9 IoCs

resource	yara_rule
behavioral2/memory/4788-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-2-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-7-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-12-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4788-13-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5048	3284	WerFault.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85
PID 3284 wrote to memory of 4788	3284	NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caaeexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 252
  2⤵
  - Program crash
  PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3284 -ip 3284
1⤵
PID:4572

memory/4788-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-9-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/4788-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4788-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download