povertystealer | d0a4321a9aa24d48a3fe146368ab5c3044f0228f55ac32ef21267b70284dc6fc

Analysis

max time kernel
125s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 14:03

Target

file.exe
Size

144KB
MD5

76819982893d70b7e344387acfa587de
SHA1

3713b0000219833c5b4f819e372eb2543765a0e0
SHA256

d0a4321a9aa24d48a3fe146368ab5c3044f0228f55ac32ef21267b70284dc6fc
SHA512

7f3f09fd4002ff6731afa01e319a3d1faf516e91e0a69bcd8a89f56939140aba5f4ad84d5becfb6fb770507c2bd53b899668381b6d7a5a27ba404488770e538a
SSDEEP

3072:bMtnJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQR4257BD4I8TJn:gZEe3bpi5aaYy57GI8TJn

Score

10^/10

Detect Poverty Stealer Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2616-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2616-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2616-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2616-8-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2616-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1960 set thread context of 2616 1960 file.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2664 1960 WerFault.exe file.exe
2724 2616 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 1960 set thread context of 2616	1960	file.exe	AppLaunch.exe

pid	pid_target	process	target process
2664	1960	WerFault.exe	file.exe
2724	2616	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

file.exeAppLaunch.exe

description	pid	process	target process
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2616	1960	file.exe	AppLaunch.exe
PID 1960 wrote to memory of 2664	1960	file.exe	WerFault.exe
PID 1960 wrote to memory of 2664	1960	file.exe	WerFault.exe
PID 1960 wrote to memory of 2664	1960	file.exe	WerFault.exe
PID 1960 wrote to memory of 2664	1960	file.exe	WerFault.exe
PID 2616 wrote to memory of 2724	2616	AppLaunch.exe	WerFault.exe
PID 2616 wrote to memory of 2724	2616	AppLaunch.exe	WerFault.exe
PID 2616 wrote to memory of 2724	2616	AppLaunch.exe	WerFault.exe
PID 2616 wrote to memory of 2724	2616	AppLaunch.exe	WerFault.exe
PID 2616 wrote to memory of 2724	2616	AppLaunch.exe	WerFault.exe
PID 2616 wrote to memory of 2724	2616	AppLaunch.exe	WerFault.exe
PID 2616 wrote to memory of 2724	2616	AppLaunch.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 196
3⤵
- Program crash
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 72
2⤵
- Program crash
PID:2664

memory/2616-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2616-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2616-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2616-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2616-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2616-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2616-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2616-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download