povertystealer | 42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7b

Analysis

max time kernel
145s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2023, 17:00

Target

NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe
Size

163KB
MD5

c6feeec40e74f5626063ddfec7706fdd
SHA1

3c1f4d0c20b1ecfbd1dfc0271caa9dc060bc1c5b
SHA256

42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7b
SHA512

11824026dda760b92c521c77b298d374a7ab62b82b6543304ad278775ca25ffdb027ec125451d0b6fdf3a15c3e54fb0bebf1a5a9c27a0d9b1bf6ff00292bef82
SSDEEP

3072:LDQIMSRlq4GrI5409wKCIfsS8B3Erm4RgLiRub4gaqKJ3iJj:LE2l540SK5sQiP+Ruk3iJj

Score

10^/10

Detect Poverty Stealer Payload 9 IoCs

resource	yara_rule
behavioral2/memory/2472-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-2-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-7-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-12-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2472-13-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83
PID 908 wrote to memory of 2472	908	NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe	83

C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS42e2fbf53b990cd8fbf576c6c69b430c1fbac1f8654f8946b60e7c5b4c6f3c7bexeexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2472

memory/2472-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-8-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/2472-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2472-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download