povertystealer | 42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17/10/2023, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe
Size

163KB
MD5

c6feeec40e74f5626063ddfec7706fdd
SHA1

3c1f4d0c20b1ecfbd1dfc0271caa9dc060bc1c5b
SHA256

42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7b
SHA512

11824026dda760b92c521c77b298d374a7ab62b82b6543304ad278775ca25ffdb027ec125451d0b6fdf3a15c3e54fb0bebf1a5a9c27a0d9b1bf6ff00292bef82
SSDEEP

3072:LDQIMSRlq4GrI5409wKCIfsS8B3Erm4RgLiRub4gaqKJ3iJj:LE2l540SK5sQiP+Ruk3iJj

Score

10^/10

povertystealer stealer

Malware Config

Signatures

Detect Poverty Stealer Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2416-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2416-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2416-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2416-8-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/2416-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2960 set thread context of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	2416	WerFault.exe	28

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2960 wrote to memory of 2416	2960	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	28
PID 2416 wrote to memory of 2216	2416	AppLaunch.exe	29
PID 2416 wrote to memory of 2216	2416	AppLaunch.exe	29
PID 2416 wrote to memory of 2216	2416	AppLaunch.exe	29
PID 2416 wrote to memory of 2216	2416	AppLaunch.exe	29
PID 2416 wrote to memory of 2216	2416	AppLaunch.exe	29
PID 2416 wrote to memory of 2216	2416	AppLaunch.exe	29
PID 2416 wrote to memory of 2216	2416	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 196
    3⤵
    - Program crash
    PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2416-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads